6.9
Medium
CVE-2026-112348 Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token
Description
Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return on empty token values to submit unlimited forms, triggering notification emails, webhooks, and unbounded writes to the submissions table without completing reCAPTCHA validation.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:NExploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- Interaction
- None
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
- Confidentiality of other systems
- None
- Integrity of other systems
- None
- Availability of other systems
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Kirki 6.2 | earliest → < 6.2.5 | 6.2.5 |
Other CVEs of Kirki
The 12 CVEs of Kirki →
CVE-2026-112347
Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST…
7.2
High
CVE-2026-42694
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki…
4.3
Medium
CVE-2026-103065
Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality…
8.2
High
CVE-2026-66629
Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions
7.1
High