Kirki Plugin HTML Injection in Password Reset Emails

Executive Summary

This vulnerability affects the Kirki WordPress plugin before version 6.0.12. It allows unauthenticated users to inject arbitrary HTML into password reset emails by exploiting unsanitized email subject and body values. The injected HTML is sent as part of the email to registered users, enabling phishing attacks.

Useful 0 Not Useful 0

Detection Guidance

Check if the Kirki plugin version is below 6.0.12 by inspecting the plugin files or WordPress admin panel. Look for unauthenticated requests to the kirki-forgot-password endpoint with HTML injection attempts in email subjects or bodies.

Useful 0 Not Useful 0

Impact Analysis

An attacker could send a crafted request to the plugin's endpoint using a known registered email address and a scraped nonce. The injected HTML in the password reset email could include deceptive links or content to trick users into revealing sensitive information or downloading malware.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling phishing attacks through manipulated password reset emails. Attackers could inject malicious HTML into emails sent to registered users, tricking them into revealing sensitive information or credentials. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information, both of which could be compromised if users fall victim to such phishing attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Kirki plugin to version 6.0.12 or later immediately. If updating is not possible, disable the plugin until the update is applied. Monitor password reset email content for unexpected HTML content.

Useful 0 Not Useful 0