Skip to content

Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-112348Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token

Medium 6.5

In plain English

A medium-severity security flaw in Kirki from Themeum. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 77.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return on empty token values to submit unlimited forms, triggering notification emails, webhooks, and unbounded writes to the submissions table without completing reCAPTCHA validation.

Affected products (as reported)

Vendor	Product	Versions
Themeum	Kirki	0 – before 6.2.5

Weakness: CWE-693 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

WordPress Plugin Changelog release-notes, patch
VulnCheck Advisory: Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token third-party-advisory