Threats tagged 'ghsa-pmw2-p788-9r7j'

The Kirki plugin for WordPress versions prior to 6.2.5 contains a vulnerability that allows unauthenticated attackers to bypass reCAPTCHA verification on frontend forms. By omitting the g-recaptcha-token field in POST requests, attackers can submit forms without valid reCAPTCHA validation. This leads to unlimited form submissions triggering notifications, webhooks, and writes to the submissions table without completing the intended verification.