{"id":"CVE-2026-112348","aliases":[],"cve":{"records":[{"id":"CVE-2026-112348","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-19T14:41:46.702Z","published":"2026-10-30T14:01:53.050Z","modified":"2026-10-30T14:01:53.050Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-30T14:01:53.050Z"}],"references":[{"url":"https://wordpress.org/plugins/kirki/#developers","tags":["release-notes","patch"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/kirki-wordpress-plugin-recaptcha-bypass-via-missing-token","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-693","description":"Protection Mechanism Failure","source":"VulnCheck"}],"applicability":[],"prioritization":[]},"title":"Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return on empty token values to submit unlimited forms, triggering notification emails, webhooks, and unbounded writes to the submissions table without completing reCAPTCHA validation.","score":6.9,"severity":"medium","published":"2026-10-30T14:01:53.050Z","modified":"2026-10-30T14:01:53.050Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Themeum","name":"Kirki","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"6.2.5","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-112348"}],"remediation":[],"references":["https://wordpress.org/plugins/kirki/#developers","https://www.vulncheck.com/advisories/kirki-wordpress-plugin-recaptcha-bypass-via-missing-token"],"sources":[{"name":"CVE","id":"CVE-2026-112348","modified":"2026-10-30T14:01:53.050Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-112348"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","score":6.9},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","score":6.5}],"sourceAffected":[],"observedAt":"2026-10-30T16:06:36.529Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T16:15:33.392Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"The Kirki WordPress plugin before version 6.2.5 has a reCAPTCHA bypass vulnerability, allowing unauthenticated attackers to submit forms without verification. The weakness is due to the verify() method's early return on empty token values. This allows attackers to submit unlimited forms, triggering notifications and writes to the submissions table.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T14:06:12.134Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-112348"}]}}