Kirki CVE-2026-13147

The vulnerable code path is the Kirki server-side URL-fetch feature that requests a user-supplied URL without validation; exploitation requires only that a site runs Kirki before 6.0.12 with that endpoint reachable, and per the CVSS PR:N/UI:N no authentication or user interaction is needed - no special non-default configuration is indicated in the description. The practical impact is limited by the site's network position: SSRF value depends on the server being able to reach sensitive internal targets (cloud metadata services, intranet hosts, internal APIs); sites with strict egress filtering or no valuable internal endpoints reachable from the web tier substantially reduce the achievable impact even though the request can still be triggered.

The signals are consistent and point to a real, high-priority issue rather than an inflated CVSS: the vector AV:N/AC:L/PR:N/UI:N describes trivial, unauthenticated, network-reachable exploitation, and publicly available exploit code lowers the barrier further. No EPSS score was provided in the input, and the vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation - the risk here is opportunistic scanning against a popular plugin rather than confirmed in-the-wild campaigns. One caveat worth verifying: the NVD/input vector claims C:H and I:H, but a pure URL-fetch SSRF typically yields confidentiality impact (reading internal responses) and often only limited integrity impact unless the SSRF can reach state-changing internal endpoints; the I:H rating may be optimistic and should be confirmed against the actual sink. Overall, given the plugin's broad footprint, unauthenticated reachability, and available POC, this warrants prompt patching.

An attacker sends a crafted unauthenticated HTTP request to the vulnerable Kirki endpoint with a URL parameter pointing at an internal service such as a cloud metadata endpoint (e.g., 169.254.169.254) or an intranet admin panel, and the WordPress server dutifully issues the request and can return or act on the response. Because publicly available exploit code exists and the CVSS vector is AV:N/AC:L/PR:N/UI:N, this can be automated at scale against exposed sites with no authentication and no user interaction.