CVE-2026-112348

MEDIUM 6.5

Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return on empty token values to submit unlimited forms, triggering notification emails, webhooks, and unbounded writes to the submissions table without completing reCAPTCHA validation.

CWE	CWE-693
Vendor	themeum
Product	kirki
Published	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for themeum kirki

Be the first to know when new medium vulnerabilities affecting themeum kirki are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Affected Versions

Themeum / Kirki

0 < 6.2.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordpress.org: https://wordpress.org/plugins/kirki/#developers vulncheck.com: https://www.vulncheck.com/advisories/kirki-wordpress-plugin-recaptcha-bypass-via-missing-token

Credits

Choriyev Qahramon (ciprobe)