CVE-2026-16747
Received Received - Intake

Unauthenticated Shortcode Execution in Kirki WordPress Plugin

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: WPScan

Description
The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-16747
EUVD
EUVD-2026-57174

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp-kirki kirki to 6.2.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Kirki WordPress plugin before version 6.2.1 has an authorization flaw in its front-end form submission REST routes. This allows unauthenticated users to submit attacker-controlled input through shortcode execution. The vulnerability enables running any shortcode registered on the site, which can lead to disclosure of sensitive information like the site administrator's email address and misuse of the site for sending emails to arbitrary recipients.

Detection Guidance

Check the installed version of the Kirki WordPress plugin. If it is below 6.2.1, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly.

Impact Analysis

If you use the Kirki plugin version before 6.2.1, an attacker could exploit this to access sensitive data such as the administrator's email address. They could also use your website to send emails to any recipient, potentially making it appear as if the emails originated from your domain. This could damage your reputation and lead to your domain being blacklisted.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal data, such as email addresses, which may violate GDPR and HIPAA requirements for protecting personal information. If exploited, it could result in data breaches, leading to legal penalties, fines, and reputational damage for organizations subject to these regulations.

Mitigation Strategies

Update the Kirki plugin to version 6.2.1 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16747. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart