CVE-2026-16747

The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.

Score
CVSS 3.1 6.5 Medium
Status
Deferred - contact@wpscan.com
Published
2026-08-12
Last modified
2026-08-12
Weaknesses
CWE-74

Affected products

References

 
 
© AVABIS GmbH privacypolicy about