The Kirki WordPress plugin versions prior to 6.2.1 do not properly authorize front-end form submission REST routes. This flaw permits unauthenticated attackers to pass attacker-controlled input through shortcode execution. Because shortcodes can execute arbitrary code or functions, this vulnerability allows attackers to run any shortcode registered on the site. On a default Kirki install, this results in disclosure of the site administrator's email address and enables an arbitrary-recipient mail relay using the victim's domain.

The vulnerability allows unauthenticated attackers to execute arbitrary shortcodes, leading to partial disclosure of sensitive information such as the site administrator's email address. Additionally, it enables attackers to use the victim's domain to relay emails to arbitrary recipients, which can facilitate spam or phishing campaigns. There is no indication of system compromise or denial of service from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 6.2.1, upgrading to version 6.2.1 or later is likely recommended once confirmed. Until then, restrict access to REST routes or disable the Kirki plugin if feasible to mitigate risk.