CVE-2026-112348— Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token

Quick assessment

Affected

Themeum Kirki

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Kirki 插件在 6.2.5 版本之前存在一个 reCAPTCHA 绕过漏洞。未认证的攻击者可以通过在提交表单的 POST 请求中省略字段，从而无需经过有效验证即可提交前端表单。攻击者可利用方法在遇到空令牌值时提前返回的特性，无限次提交表单，进而触发通知邮件、调用 Webhook，并向提交记录表中执行无限制的写入操作，而无需完成 reCAPTCHA 验证。

CVSS 6.5 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token

Source: CVE Program / CVE List V5

Vulnerability Description

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return on empty token values to submit unlimited forms, triggering notification emails, webhooks, and unbounded writes to the submissions table without completing reCAPTCHA validation.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

保护机制失效

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Themeum	Kirki	0 ~ 6.2.5	-

II. Public POCs for CVE-2026-112348

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-112348

请登录查看更多情报信息。

Other References for CVE-2026-112348 (2)

https://wordpress.org/plugins/kirki/#developers release-notes patch
https://www.vulncheck.com/advisories/kirki-wordpress-plugin-recaptcha-bypass-via-missing-token third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-112348

IV. Related Vulnerabilities

Same product: Kirki

Same vendor: Themeum

Same weakness: CWE-693