The vulnerability is a subscriber Server Side Request Forgery (SSRF) in the Kirki WordPress plugin, versions 6.0.11 or earlier. It grants an attacker the ability to cause the affected web server to send HTTP requests to arbitrary internal or external endpoints. This can expose sensitive data, trigger privileged operations, or be used to pivot to other systems on the network. The flaw is classified as CWE‑918, indicating a lack of proper URL validation.

WordPress users running the Themeum Kirki plugin through version 6.0.11 or earlier are affected. No additional product or vendor details are specified beyond the plugin name and version threshold.

The CVSS score of 4.9 points to a moderate risk profile. The EPSS score is not available, indicating no publicly documented exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve an authenticated or unauthenticated user interacting with the plugin’s input fields to supply crafted URLs, causing the server to resolve them internally. The exploit does not appear to require elevated privileges beyond normal user access to the repository where the plugin processes input.