Kirki Plugin reCAPTCHA Bypass Vulnerability

Executive Summary

The Kirki plugin for WordPress before version 6.2.5 has a vulnerability that lets unauthenticated attackers bypass reCAPTCHA checks. By omitting the g-recaptcha-token field in POST requests, attackers can submit frontend forms without completing reCAPTCHA validation. This happens because the verify() method returns early when the token is empty, allowing unlimited form submissions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP POST requests to WordPress form submission endpoints for missing or invalid g-recaptcha-token fields. Check server logs for repeated form submissions without reCAPTCHA verification. Inspect the Kirki plugin version; if it is below 6.2.5, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to submit unlimited forms, triggering notification emails, webhooks, and writing excessive data to the submissions table. This could lead to spam, resource exhaustion, or denial of service on your WordPress site.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Kirki plugin to version 6.2.5 or later. If updating is not possible, disable the plugin or restrict form submissions to authenticated users only. Review server logs for signs of exploitation and block suspicious IP addresses.

Useful 0 Not Useful 0