Kirki WordPress Plugin CVE-2026-112348

Exploitation requires the target site to be running Kirki before 6.2.5 AND to have at least one of the plugin's frontend form submission features configured with reCAPTCHA as its protection. The attacker then sends POST requests to that form submission endpoint while omitting the g-recaptcha-token field, abusing verify()'s early return on empty token values. No authentication, privileges, or user interaction are required (PR:N/UI:N), and default configurations of the form feature are affected once reCAPTCHA is in use. The principal limiting factor is feature deployment: sites that do not use Kirki's frontend forms, or do not rely on reCAPTCHA for them, have no exposed surface, so the real-world population is narrower than the plugin's total install base.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 4.0 score of 6.9 (medium) reflects an easy attack profile - AV:N/AC:L/AT:N/PR:N/UI:N means remote, unauthenticated, low-complexity exploitation with no user interaction - but the impact metrics cap the damage at VI:L/VA:L with VC:N: no confidentiality loss, no code execution, no privilege gain. The realistic harm is abuse (spam emails, webhook flooding, unbounded growth of the submissions table), consistent with CWE-693 (protection mechanism failure) rather than system compromise. The vuln.today decision label is 'this_month', which aligns with that medium severity and argues against treating it as act_now/emergency. Key signals are missing or absent: there is no CISA KEV listing, no EPSS exploitation-probability score was provided, and no public exploit code is identified - the two references are an NVD pointer to the plugin page and a VulnCheck advisory, neither of which is verified working exploit code. The signals are internally consistent (low real impact, easy but non-critical) rather than conflicting; the main gap is the absence of an EPSS score to gauge real-world exploitation likelihood.

An attacker finds a WordPress site running Kirki before 6.2.5 that exposes a reCAPTCHA-protected frontend form and scripts automated POST requests to the submission endpoint, each one omitting the g-recaptcha-token field. Because the verify() method returns early on an empty token, every request is accepted, letting the attacker submit unlimited forms that generate spam notification emails, fire webhooks, and bloat the submissions database table. No public exploit is identified at time of analysis, though the token-omission technique is simple to reproduce from the description.