CVE-2026-112348
Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 30, 2026
- Updated
- Oct 30, 2026
- Reserved
- Oct 19, 2026
Description
Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return on empty token values to submit unlimited forms, triggering notification emails, webhooks, and unbounded writes to the submissions table without completing reCAPTCHA validation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L | VulnCheck |
Weaknesses
- CWE-693 Protection Mechanism Failure
Affected Products
| Product | Versions |
|---|---|
KirkiThemeum |
|
References
- WordPress Plugin Changelogrelease-notespatch
- VulnCheck Advisory: Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Tokenthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.