Vulnerability in Kirki – Freeform Page Builder, Website Builder & Customizer — CVE-2026-112348

What to do now

Update Kirki – Freeform Page Builder, Website Builder & Customizer to 6.2.5 or later.

Affected versions

• Everything before 6.2.5

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return on empty token values to submit unlimited forms, triggering notification emails, webhooks, and unbounded writes to the submissions table without completing reCAPTCHA validation.

This description is reproduced verbatim from the public vulnerability record.

• https://wordpress.org/plugins/kirki/#developers
• https://www.vulncheck.com/advisories/kirki-wordpress-plugin-recaptcha-bypass-via-missing-token

This page is compiled automatically from public databases. Accuracy is not guaranteed; confirm against the vendor advisory before acting.