CVE-2026-112348 Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify...

CVE-2026-112348

The Kirki plugin for WordPress (versions before 6.2.5 ) is vulnerable to a reCAPTCHA bypass due to a flaw in the verify() method. Unauthenticated attackers can submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests. The method incorrectly perfo...

PT-2026-133571

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify...