The vulnerability in the Kirki WordPress plugin allows an unauthenticated user to submit form data through exposed REST routes. Attackers can inject arbitrary shortcode payloads because the plugin fails to properly enforce authorization on these endpoints. The effect is that any shortcode registered on the site can be executed, which, in a stock installation, reveals the site administrator's email address and can be used to send emails to arbitrary recipients from the victim's domain. This compromise affects confidentiality through email disclosure and availability or integrity if the mail relay is abused for phishing or spam.

The affected product is the Kirki WordPress plugin for all WordPress sites where the plugin version is 6.2.0 or older. No other vendors product names are listed. The issue relies on unauthenticated access to REST routes that are part of the plugin’s front‑end form submission functionality.

Based on the CVSS score of 6.5, the vulnerability is considered moderately severe. The EPSS score is not available, so the current exploitation likelihood cannot be quantified, and the vulnerability is not listed in KEV. Attackers can reach the vulnerable endpoint without authentication by sending crafted REST requests from any origin, making exploitation straightforward for anyone with network access to the WordPress site. The risk is particularly high for sites with the default shortcode set, which includes the mail relay functionality.