Live › vulnerability › CVE-2026-112348
Kirki, a WordPress theme-customization plugin, skips its reCAPTCHA check when the token field is left out of a form submission. An unauthenticated attacker can flood forms, triggering notification emails, webhooks and unlimited writes to the submissions table.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 14:30 UTC. All times on this page are UTC.
Sites running the Kirki plugin before 6.2.5 that accept frontend forms protected by reCAPTCHA are exposed. Sites without Kirki, or without public forms, can skip it. The sources do not say whether the flaw depends on a specific reCAPTCHA configuration.
No product ranges from the sources yet.
wp plugin get kirki --field=version6.2.5 or later (per the advisory's 'before 6.2.5' range)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return on empty token values to submit unlimited forms, triggering notification emails, webhooks, and unbounded writes to the submissions table without completing reCAPTCHA validation.
This page as .md · .json · in your agent: get_signal("CVE-2026-112348")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.