---
id: "CVE-2026-112348"
kind: "vulnerability"
aliases: ["CVE-2026-112348"]
title: "Kirki WordPress plugin: reCAPTCHA check skipped, letting bots submit forms"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["forms", "kirki", "package", "recaptcha", "wordpress"]
not_affected_if: ["kirki-6.2.5-or-later", "kirki-not-installed", "no-public-forms"]
published_at: "2026-10-30T14:16:38+00:00"
first_seen_at: "2026-10-30T14:30:53+00:00"
updated_at: "2026-10-30T14:32:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112348", "first_seen_at": "2026-10-30T14:30:53+00:00"}]
---

# Kirki WordPress plugin: reCAPTCHA check skipped, letting bots submit forms

Kirki, a WordPress theme-customization plugin, skips its reCAPTCHA check when the token field is left out of a form submission. An unauthenticated attacker can flood forms, triggering notification emails, webhooks and unlimited writes to the submissions table.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kirki version in the WordPress admin under Plugins, or with `wp plugin get kirki --field=version`
- Look for the plugin's frontend form submissions and whether reCAPTCHA is enabled on them

## Fix

- Kirki plugin for WordPress: `6.2.5` or later (per the advisory's 'before 6.2.5' range)

## Timeline

- 2026-10-30T14:30:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112348

## From the sources

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return on empty token values to submit unlimited forms, triggering notification emails, webhooks, and unbounded writes to the submissions table without completing reCAPTCHA validation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_