6.5
Medium
CVE-2026-16747 The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes…
Description
The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Kirki 6.2 | earliest → < 6.2.1 | 6.2.1 |
Other CVEs of Kirki
The 15 CVEs of Kirki →
CVE-2026-84220
The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders…
4.8
Medium
CVE-2026-84224
The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing…
4.1
Medium
CVE-2026-84223
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide,…
6.8
Medium
CVE-2026-84222
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering…
5.3
Medium