CVE-2026-16747

The Kirki WordPress plugin, prior to version 6.2.1, has a security vulnerability that allows unauthenticated users to submit forms and execute any registered shortcode on the site. This is due to inadequate authorization of front-end form submission REST routes, which allows attackers to pass malicious input through shortcode execution. As a result, an attacker can potentially obtain sensitive information, such as the site administrator's email address, and even send emails from the victim's domain to arbitrary recipients.

Based on public CVE data (MITRE/NVD).