{"id":"CVE-2026-112348","kind":"vulnerability","aliases":["CVE-2026-112348"],"related":[],"title":"Kirki WordPress plugin: reCAPTCHA check skipped, letting bots submit forms","description":"Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return on empty token values to submit unlimited forms, triggering notification emails, webhooks, and unbounded writes to the submissions table without completing reCAPTCHA validation.","summary":"Kirki, a WordPress theme-customization plugin, skips its reCAPTCHA check when the token field is left out of a form submission. An unauthenticated attacker can flood forms, triggering notification emails, webhooks and unlimited writes to the submissions table.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["forms","kirki","package","recaptcha","wordpress"],"not_affected_if":["kirki-6.2.5-or-later","kirki-not-installed","no-public-forms"],"how_to_check":"- Check the installed Kirki version in the WordPress admin under Plugins, or with `wp plugin get kirki --field=version`\n- Look for the plugin's frontend form submissions and whether reCAPTCHA is enabled on them","fix":"- Kirki plugin for WordPress: `6.2.5` or later (per the advisory's 'before 6.2.5' range)","status":"open","published_at":"2026-10-30T14:16:38+00:00","first_seen_at":"2026-10-30T14:30:53+00:00","triaged_at":"2026-10-30T14:32:45+00:00","updated_at":"2026-10-30T14:32:45+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T14:32:45Z","model":"claude-haiku-5-5","output":{"fix":"- Kirki plugin for WordPress: `6.2.5` or later (per the advisory's 'before 6.2.5' range)","reach":"internet","title":"Kirki WordPress plugin: reCAPTCHA check skipped, letting bots submit forms","impact":"low","summary":"Kirki, a WordPress theme-customization plugin, skips its reCAPTCHA check when the token field is left out of a form submission. An unauthenticated attacker can flood forms, triggering notification emails, webhooks and unlimited writes to the submissions table.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","kirki","reCAPTCHA","forms"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated bots flood form submissions and notifications, filling the database","analyst_note":"","how_to_check":"- Check the installed Kirki version in the WordPress admin under Plugins, or with `wp plugin get kirki --field=version`\n- Look for the plugin's frontend form submissions and whether reCAPTCHA is enabled on them","plain_action":"","needs_analyst":false,"not_affected_if":["kirki-not-installed","kirki-6.2.5-or-later","no-public-forms"],"who_is_affected":"Sites running the Kirki plugin before 6.2.5 that accept frontend forms protected by reCAPTCHA are exposed. Sites without Kirki, or without public forms, can skip it. The sources do not say whether the flaw depends on a specific reCAPTCHA configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000714,"input_tokens":4202,"output_tokens":587,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112348':13A,16A '-2026':12A,15A '6.2.5':66C 'allow':73C 'attack':46B,75C,99C 'bot':8A 'bypass':70C 'check':5A,32B 'complet':128C 'contain':67C 'custom':27B 'cve':11A,14A 'earli':106C 'email':52B,118C 'empti':109C 'endpoint':98C 'exploit':101C 'field':36B,90C 'flood':48B 'form':10A,17B,42B,49B,79C,96C,115C 'frontend':78C 'g':87C 'g-recaptcha-token':86C 'kirki':1A,18B,22B,61C 'left':38B 'let':7A 'method':104C 'notif':51B,117C 'omit':84C 'packag':19B 'plugin':3A,28B,62C 'post':92C 'recaptcha':4A,20B,31B,69C,88C,129C 'request':93C 'return':107C 'skip':6A,29B 'submiss':43B,59B,97C,125C 'submit':9A,77C,113C 'tabl':60B,126C 'theme':26B 'theme-custom':25B 'token':35B,89C,110C 'trigger':50B,116C 'unauthent':45B,74C 'unbound':121C 'unlimit':55B,114C 'valid':81C,130C 'valu':111C 'verif':82C 'verifi':103C 'vulner':71C 'webhook':53B,119C 'without':80C,127C 'wordpress':2A,21B,24B,64C 'write':56B,122C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Kirki plugin before 6.2.5 that accept frontend forms protected by reCAPTCHA are exposed. Sites without Kirki, or without public forms, can skip it. The sources do not say whether the flaw depends on a specific reCAPTCHA configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T14:16:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112348","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112348","severity":null,"published_at":"2026-10-30T14:16:38+00:00","modified_at":"2026-10-30T14:16:38+00:00","first_seen_at":"2026-10-30T14:30:53+00:00","fetched_at":"2026-10-30T14:30:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}