Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.4 - Unauthenticated reCAPTCHA Validation Bypass

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 6.2.4. This is due to an early return in the Recaptcha::verify() method when the supplied token is empty, allowing the check to be skipped entirely by omitting the g-recaptcha-token field from the POST request. This makes it possible for unauthenticated attackers to submit frontend forms without completing reCAPTCHA validation, triggering notification emails, webhooks, and unbounded writes to the submissions table. A form with reCAPTCHA enabled must be present on the site.

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: Kirki 6.2.5 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts