CVE-2026-112348
Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows…
- Risk score
- 43/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early retur…
- Affected
- See advisory
- Fix
- Upgrade the product to 6.2.5 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
Original description
Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return on empty token values to submit unlimited forms, triggering notification emails, webhooks, and unbounded writes to the submissions table without completing reCAPTCHA validation.
Last activity 30 Oct 2026. Patch Forecast updates every hour.