---
id: CVE-2026-112348
title: Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token
summary: >-
  Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass
  vulnerability that allows unauthenticated attackers to submit frontend forms
  without valid verification by omitting the g-recaptcha-token field from POST
  requests to the…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-693
vendor: Themeum
product: Kirki
affected:
  - Kirki < 6.2.5
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-04T22:30:04.402054Z'
published: '2026-10-30'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T22:30:23.613Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112348'
references:
  - url: 'https://wordpress.org/plugins/kirki/#developers'
    label: WordPress Plugin Changelog
  - url: >-
      https://www.vulncheck.com/advisories/kirki-wordpress-plugin-recaptcha-bypass-via-missing-token
    label: >-
      VulnCheck Advisory: Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via
      Missing Token
tags:
  - cve.org
epss: 0.00294
epssPercentile: 0.22175
ingestedAt: '2026-11-05T21:36:00.649Z'
---

## Overview

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return on empty token values to submit unlimited forms, triggering notification emails, webhooks, and unbounded writes to the submissions table without completing reCAPTCHA validation.

## Affected

- `Kirki < 6.2.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.