CVE-2026-16747 in Kirki Plugin
Summary
by MITRE • 08/12/2026
The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability in the Kirki WordPress plugin affects versions prior to 6.2.1 and represents a critical authorization bypass that undermines the security posture of affected websites. This issue stems from improper access controls on front-end form submission REST routes, which should require authentication but instead allow unauthenticated users to interact with sensitive functionality. The flaw creates an attack surface where malicious actors can exploit the plugin's shortcode execution mechanism without proper authorization. When combined with the lack of input sanitization, this vulnerability enables attackers to manipulate the shortcode processing pipeline and execute arbitrary shortcodes registered on the target website. The technical implementation appears to fail in validating user permissions before allowing REST API calls to proceed, creating a path for privilege escalation through front-end interfaces that should remain restricted to authenticated administrators.
The operational impact of this vulnerability extends beyond simple information disclosure to include active attack vectors that can be leveraged for further compromise. On default WordPress installations, the vulnerability exposes the administrator's email address which serves as a critical piece of information for social engineering campaigns and targeted attacks. More concerning is the arbitrary-recipient mail relay capability that allows attackers to send emails from the victim domain to any recipient, effectively enabling spamming activities while potentially masking attack origins through legitimate domain spoofing. This functionality can be exploited to deliver phishing content, spread malware, or conduct reputation damage campaigns against the compromised site. The vulnerability's exploitation requires minimal technical skill and provides substantial attack surface advantages, making it particularly dangerous for widespread abuse.
Security professionals should understand that this vulnerability aligns with multiple CWE categories including CWE-285 for insufficient authorization and CWE-79 for cross-site scripting through untrusted input. The ATT&CK framework would categorize this under T1059 for command and scripting interpreter and potentially T1566 for phishing through social engineering campaigns that leverage the exposed email addresses. Organizations should prioritize immediate patching of the Kirki plugin to version 6.2.1 or later, as this represents the most effective mitigation strategy. Additional defensive measures include implementing rate limiting on REST API endpoints, monitoring for unusual shortcode execution patterns, and conducting regular security audits of plugin installations. Network-level protections such as web application firewalls can provide additional layers of defense by detecting and blocking suspicious REST API requests that attempt to exploit this authorization bypass. The vulnerability demonstrates the critical importance of proper access control implementation in WordPress plugins and highlights how front-end interfaces can become attack vectors when not properly secured against unauthorized access attempts.