CVE-2026-16747: Kirki WordPress Plugin Auth Bypass Flaw

CVE-2026-16747 Overview

CVE-2026-16747 affects the Kirki WordPress plugin in versions before 6.2.1. The plugin exposes REST API routes for front-end form submissions without proper authorization checks. Attacker-controlled input passes through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site. On a default WordPress installation, this leads to disclosure of the site administrator's email address and enables an arbitrary-recipient mail relay from the victim's domain. The flaw is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated attackers can execute arbitrary shortcodes, disclose administrator email addresses, and abuse the site as a mail relay to send messages to arbitrary recipients from the victim's domain.

Affected Products

Kirki WordPress plugin versions prior to 6.2.1
WordPress sites with Kirki installed and shortcodes registered
Default WordPress installations using vulnerable Kirki versions

Discovery Timeline

2026-08-12 - CVE-2026-16747 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-16747

Vulnerability Analysis

The Kirki plugin registers REST API endpoints intended to accept front-end form submissions. These endpoints omit proper authorization checks, so any unauthenticated client can invoke them. The submission handler subsequently passes attacker-controlled input into WordPress shortcode processing routines. Because WordPress evaluates any registered shortcode encountered in the input string, the attacker gains a primitive for arbitrary shortcode execution.

On a default WordPress installation, several built-in shortcodes provide directly abusable functionality. Attackers can trigger shortcodes that expose the administrator's email address. They can also invoke mail-sending shortcodes to relay messages to arbitrary recipients from the site's domain, degrading the domain's sending reputation and enabling phishing.

Root Cause

The root cause is a missing capability check on the REST route combined with unsafe use of do_shortcode() (or an equivalent function) on user-supplied input. The plugin trusts the REST request payload and forwards it through shortcode expansion without sanitizing or restricting which shortcodes may execute. This design conflates form submission data with template content.

Attack Vector

Exploitation requires only network access to the REST endpoint. The attacker crafts an HTTP POST request to the vulnerable Kirki front-end form submission route and embeds a WordPress shortcode string in a form field. The server processes the shortcode server-side and returns or acts on the result. See the WPScan Vulnerability Report for additional technical detail on the affected routes.

Detection Methods for CVE-2026-16747

Indicators of Compromise

Unauthenticated POST requests to Kirki REST routes under /wp-json/ containing shortcode syntax such as [ and ] in request parameters
Outbound email from the site to unexpected recipients, particularly bulk or externally addressed messages triggered by web requests
Web server access logs showing repeated calls to Kirki form submission endpoints from a small set of source IPs

Detection Strategies

Inspect WordPress REST API traffic for request bodies containing bracketed shortcode patterns targeting Kirki endpoints
Correlate WordPress wp_mail() invocations with inbound REST requests to identify mail relay abuse
Alert on version fingerprints identifying Kirki plugin installations below 6.2.1 during external scans

Monitoring Recommendations

Enable WordPress debug logging and forward web server access logs to a centralized log platform for REST API analysis
Monitor SMTP send volume from the WordPress host and alert on deviations from baseline
Track plugin inventory across managed WordPress sites and flag installations of vulnerable Kirki versions

How to Mitigate CVE-2026-16747

Immediate Actions Required

Update the Kirki plugin to version 6.2.1 or later on all WordPress sites
Audit web server and mail logs for signs of prior exploitation, including anomalous outbound mail
Rotate the administrator email address if disclosure is suspected and review it for exposure in public sources

Patch Information

The vendor addressed the issue in Kirki version 6.2.1. The fix introduces authorization checks on the affected REST routes and prevents attacker-controlled input from reaching shortcode expansion. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the Kirki plugin until the upgrade to 6.2.1 can be deployed
Block unauthenticated access to Kirki REST routes at a web application firewall or reverse proxy
Restrict outbound SMTP from the WordPress host to known, approved relays to limit mail abuse impact

bash

# Example: block unauthenticated access to Kirki REST routes at the web server
# nginx snippet
location ~ ^/wp-json/kirki/ {
    if ($http_authorization = "") {
        return 403;
    }
}