The Kirki WordPress plugin before version 6.2.5 contains a reCAPTCHA bypass that lets unauthenticated users submit forms without providing a g‑recaptcha‑token. The verify() method returns early when the token field is empty, allowing attackers to flood the site’s form‑submission endpoint. This can result in unlimited notification emails, webhook triggers, and unbounded writes to the submissions database, effectively enabling spam and potential denial‑of‑service conditions.

The vulnerability affects Themeum Kirki plugin for WordPress, specifically any installation running a version earlier than 6.2.5. WordPress sites that have the plugin installed and rely on its built‑in reCAPTCHA protection are at risk.

The CVSS score is 6.9, indicating a moderate to high severity. EPSS is not available and the issue is not listed in CISA’s KEV catalog, but the attack requires only unauthenticated POST requests to the form‑submission endpoint and relies on the plugin’s missing token validation. Attackers can exploit it repeatedly to trigger spam or resource exhaustion without any special credentials, making the risk tangible for sites that run the vulnerable plugin.