Description
The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).
Published: 2026-07-20
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Kirki WordPress plugin allows the server to fetch a URL supplied by a user without validation. An unauthenticated attacker can thereby force the site to make HTTP requests to arbitrary hosts, potentially exposing internal resources or facilitating further attacks.

Affected Systems

The weakness impacts the Kirki plugin for WordPress on all versions older than 6.0.12. The vendor is listed only as Kirki.

Risk and Exploitability

The CVSS score of 9.1 marks this as high severity, while an EPSS score of less than 1% indicates a currently low probability of exploitation. It is not listed in the CISA KEV catalog. Based on the description, the likely attack path is via the unauthenticated kirki_get_apis endpoint, which accepts a URL parameter and initiates a server‑side request without validation.

Generated by OpenCVE AI on August 4, 2026 at 06:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Kirki plugin to version 6.0.12 or later
  • If an upgrade cannot be performed immediately, disable the Kirki plugin or remove it from the WordPress installation
  • As a temporary control, block the kirki_get_apis endpoint or restrict outbound HTTP requests from the server with a firewall or web application firewall

Generated by OpenCVE AI on August 4, 2026 at 06:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 06:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-918

Sun, 02 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Kirki
Kirki kirki
Wordpress
Wordpress wordpress
Vendors & Products Kirki
Kirki kirki
Wordpress
Wordpress wordpress

Sat, 01 Aug 2026 07:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-918

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-918

Sun, 26 Jul 2026 08:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-918

Tue, 21 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-918

Mon, 20 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 20 Jul 2026 07:15:00 +0000

Type Values Removed Values Added
Description The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).
Title Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis
References

Subscriptions

Kirki Kirki
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-07-20T13:13:37.074Z

Reserved: 2026-06-24T09:16:56.966Z

Link: CVE-2026-13147

cve-icon Vulnrichment

Updated: 2026-07-20T13:13:22.591Z

cve-icon NVD

Status : Deferred

Published: 2026-07-20T07:16:35.580

Modified: 2026-07-20T20:39:31.217

Link: CVE-2026-13147

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T06:15:04Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-918

    Server-Side Request Forgery (SSRF)