Description

The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-12T12:17:47.053Z",
  "pubdate": "2026-08-12T12:17:47.053Z",
  "executiveSummary": "The Kirki WordPress plugin before version 6.2.1 suffers from an authorization bypass vulnerability affecting its front-end form submission REST API routes.\nThis security defect allows unauthenticated remote attackers to interact with vulnerable REST endpoints and supply arbitrary input that is subsequently processed through WordPress shortcode execution mechanisms.\nSuccessful exploitation enables unauthenticated threat actors to invoke arbitrary shortcodes registered within the target WordPress environment, circumventing standard access controls.\nOn a default installation, this capability results in the unauthorized disclosure of the site administrator's email address and facilitates an arbitrary-recipient mail relay vector utilizing the victim domain's mail server infrastructure.\nThe vulnerability represents a significant risk to confidentiality and integrity, exposing underlying application logic and server-side functionality to malicious external manipulation without requiring prior authentication or privileged access.",
  "technicalDetails": "The root cause of the vulnerability resides in the inadequate authorization checks implemented within the REST API routes handling front-end form submissions in the Kirki WordPress plugin.\nSpecifically, the affected REST endpoints fail to properly validate whether the requesting entity possesses the necessary permissions to execute the associated operations.\nFurthermore, the application accepts attacker-controlled input via these routes and insecurely passes it into shortcode execution routines without adequate sanitization, validation, or context-aware escaping.\nThe attack flow proceeds as follows: An unauthenticated attacker crafts an HTTP request targeting the exposed Kirki REST API routes.\nThe attacker includes malicious parameters containing arbitrary shortcode syntax within the payload.\nBecause the REST endpoint lacks proper authorization validation, the request is processed by the application.\nThe vulnerable component extracts the attacker-controlled input and executes the embedded shortcodes via the WordPress shortcode processing engine.\nThe network exposure is public, permitting any external network-adjacent attacker to invoke the REST endpoints directly.\nAuthentication and privilege requirements are entirely absent, allowing unauthenticated users to trigger the functionality.\nIn the context of a default WordPress installation, payload execution via specific shortcodes leads directly to the extraction and disclosure of the site administrator's sensitive email address.\nAdditionally, it enables the abuse of mailing functionalities tied to shortcode execution, resulting in an arbitrary-recipient mail relay vulnerability that can be leveraged for spam distribution or phishing campaigns under the guise of the compromised domain."
}