CVE-2026-16747: 
WordPress vulnerability analysis and mitigation

CVE-2026-16747 is an unauthenticated arbitrary shortcode execution vulnerability in the Kirki WordPress plugin (by Themeum) affecting all versions before 6.2.1. The flaw allows unauthenticated attackers to execute any shortcode registered on the site via improperly authorized front-end REST API routes, leading to administrator email disclosure and mail relay abuse. It was publicly disclosed on August 10, 2026, with the GitHub Advisory (GHSA-p469-wjxr-57rr) published on August 12, 2026. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (WPScan, GitHub Advisory).

The root cause is an authorization bypass (CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component) in Kirki's front-end form submission REST API routes, which lack proper authentication or capability checks. Attacker-controlled input is passed directly into WordPress's do_shortcode() function (or equivalent), enabling execution of any shortcode registered on the site without authentication. The attack vector is network-based, requires no privileges or user interaction, and is automatable, making it trivially exploitable at scale. The original researcher credited is Jakub Herman (WPScan, GitHub Advisory).

Successful exploitation allows unauthenticated attackers to execute any WordPress shortcode registered on the target site. On a default WordPress installation, this leads to disclosure of the site administrator's email address and the ability to send arbitrary emails from the victim's domain (mail relay abuse), which can facilitate phishing campaigns or spam operations. While availability is unaffected, both confidentiality (email disclosure) and integrity (unauthorized mail relay) are partially compromised (WPScan, GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. WPScan has indicated that a PoC will be published on August 24, 2026, to allow time for users to update. The vulnerability is rated automatable by NVD SSVC analysis, meaning it can be exploited at scale without manual interaction. The EPSS score is 0.0, and it is not currently listed in the CISA Known Exploited Vulnerabilities catalog (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the Kirki plugin (versions < 6.2.1) using tools like WPScan, Shodan, or by checking /wp-content/plugins/kirki/ for plugin presence.
2. Identify vulnerable REST endpoint: Locate the Kirki front-end form submission REST API route (e.g., a route under /wp-json/kirki/ or similar) that handles form email actions without authentication.
3. Craft malicious request: Send an unauthenticated HTTP POST request to the vulnerable REST endpoint, injecting a shortcode payload (e.g., [wp_mail to='attacker@example.com' subject='test' message='test'] or [get_option option='admin_email']) as attacker-controlled input in the form submission parameters.
4. Trigger shortcode execution: The server processes the attacker-supplied shortcode via WordPress's shortcode execution engine without authorization checks.
5. Achieve objective: Retrieve the administrator's email address from the response, or abuse the mail relay functionality to send arbitrary emails from the victim's domain to any recipient (WPScan).

• Network: Unusual unauthenticated HTTP POST requests to Kirki REST API endpoints (e.g., paths matching /wp-json/kirki/*/form or similar form submission routes) from external IP addresses; outbound SMTP traffic from the web server to unexpected recipients.
• Logs: WordPress access logs showing repeated unauthenticated POST requests to Kirki REST routes with shortcode-like strings (e.g., [, ]) in request bodies; PHP error logs referencing unexpected shortcode execution.
• Email: Unexpected outbound emails originating from the site's domain to external or unknown recipients, particularly in bulk or with unusual subjects/content consistent with spam or phishing.

Update the Kirki WordPress plugin to version 6.2.1 or later, which introduces proper authorization checks on the front-end form submission REST routes. No official configuration-based workaround has been published; upgrading is the recommended and primary remediation. As an interim measure, site administrators can consider disabling the Kirki plugin until the update can be applied, or restricting access to the WordPress REST API for unauthenticated users via firewall rules or security plugins (WPScan, GitHub Advisory).