CyberRota Analysis
AI-GeneratedThe Kirki WordPress plugin prior to version 6.2.1 is vulnerable due to improper authorization of front-end form submission REST routes, enabling unauthenticated users to execute any registered shortcode. This flaw can lead to the exposure of the site administrator's email address and facilitate arbitrary email relay from the victim's domain. WordPress site administrators using this plugin should prioritize updating to version 6.2.1 or later to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.