CVE-2026-112348

Description

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return on empty token values to submit unlimited forms, triggering notification emails, webhooks, and unbounded writes to the submissions table without completing reCAPTCHA validation.

References

https://www.vulncheck.com/advisories/kirki-wordpress-plugin-recaptcha-bypass-via-missing-token

https://wordpress.org/plugins/kirki/#developers

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-114057

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS