CVE-2026-16747
MediumCVSS 6.5Summary
The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.
Risk Assessment
The risk includes disclosure of sensitive administrator information and use of the server for spam distribution, which can harm domain reputation.
Recommendation
It is recommended to immediately update the plugin to version 6.2.1 or later and implement proper authorization for REST routes.
Original NVD description (English source)
The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.