CVE-2026-112348: Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token

Q: Who is exposed to this issue?

WordPress sites using the Kirki plugin before version 6.2.5 are exposed where frontend forms rely on its reCAPTCHA verification. An attacker does not need an account or user interaction.

Q: What does an attacker need to do to bypass verification?

The attacker can send a POST request to the form submission endpoint while omitting the g-recaptcha-token field. The affected verification method returns early when the token is empty, allowing the submission to proceed without reCAPTCHA validation.

Q: What impact can successful exploitation have?

Attackers can submit unlimited frontend forms, potentially generating notification emails and webhooks. The submissions table may also receive unbounded writes, which can affect availability.

Q: How can I tell whether my site may be affected?

Check whether Kirki is installed at a version earlier than 6.2.5 and whether frontend forms use its reCAPTCHA validation. Review form submission records, notification email volume, webhook activity, and POST requests for submissions missing the g-recaptcha-token field.

Published Oct 30, 2026

Updated

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return on empty token values to submit unlimited forms, triggering notification emails, webhooks, and unbounded writes to the submissions table without completing reCAPTCHA validation.

Event History

Oct 30, 2026

CVE Published

via MITRE·02:01 PM

Data Sourced

via MITRE·02:01 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

WordPress sites using the Kirki plugin before version 6.2.5 are exposed where frontend forms rely on its reCAPTCHA verification. An attacker does not need an account or user interaction.

What does an attacker need to do to bypass verification?

The attacker can send a POST request to the form submission endpoint while omitting the g-recaptcha-token field. The affected verification method returns early when the token is empty, allowing the submission to proceed without reCAPTCHA validation.

What impact can successful exploitation have?

Attackers can submit unlimited frontend forms, potentially generating notification emails and webhooks. The submissions table may also receive unbounded writes, which can affect availability.

How can I tell whether my site may be affected?

Check whether Kirki is installed at a version earlier than 6.2.5 and whether frontend forms use its reCAPTCHA validation. Review form submission records, notification email volume, webhook activity, and POST requests for submissions missing the g-recaptcha-token field.

CVE-2026-112348: Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to bypass verification?

What impact can successful exploitation have?

How can I tell whether my site may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to bypass verification?

What impact can successful exploitation have?

How can I tell whether my site may be affected?