EUVD-2026-45889
GHSA-74x7-v2vc-6vgc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network SSRF with no interaction (AV:N/AC:L/PR:N/UI:N); high confidentiality from internal data access, but integrity only limited (I:L) absent a confirmed state-changing sink.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).
Articles & Coverage 2
AnalysisAI
Server-Side Request Forgery in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to coerce the server into issuing HTTP requests to arbitrary attacker-chosen hosts because a user-supplied URL is fetched server-side without validation. This is reachable remotely with no authentication or user interaction (CVSS 9.1), publicly available exploit code exists, and a vendor patch has shipped, but there is no public exploit identified as being used in active attacks (not in CISA KEV). Reported by WPScan (EUVD-2026-45889), the flaw is dangerous on WordPress sites hosted in cloud or internal-network environments where the request can pivot to metadata or intranet services.
Technical ContextAI
Kirki is a widely used WordPress customizer/theme-options toolkit that themes and plugins rely on to build settings panels, so it is embedded across many sites rather than run standalone. The root cause is a classic SSRF (CWE-918, Server-Side Request Forgery - the input CWE field was 'N/A' so this class is inferred from the described behavior): the plugin accepts a URL parameter and performs a server-side HTTP fetch of it without allow-listing schemes, resolving DNS, or blocking internal/loopback/link-local address ranges. Because WordPress runs the fetch with the site's own network position and credentials context, an attacker's chosen destination is contacted by the trusted server. The CPE is recorded generically as cpe:2.3:a:unknown:kirki:*:*:*:*:*:*:*:*, so the vendor namespace is not authoritatively fixed in the input data.
RemediationAI
Upgrade the Kirki plugin to version 6.0.12 or later, which is the vendor-released patch that adds validation of the user-supplied URL before the server-side request. If immediate patching is not possible, restrict outbound connectivity from the web server so it cannot reach internal or cloud-metadata addresses - block egress to 169.254.169.254, RFC1918 ranges, and loopback at the host or network firewall (trade-off: may break legitimate internal integrations the site relies on); place a filtering egress proxy in front of the site to allow-list permitted external hosts; and use a WAF rule to block requests carrying attacker-controlled URL parameters to the vulnerable endpoint. Confirm the fix and any advisory notes via WPScan at https://wpscan.com/vulnerability/f39c3e35-8673-4095-a829-a9ec2624f66c/. Because Kirki is often bundled by themes, also verify no theme ships an older embedded copy after updating.
SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbit
PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users
Stored cross-site scripting in the Kirki WordPress plugin before 6.3.0 allows unauthenticated remote attackers to persis
Arbitrary file upload via malformed archive in the Kirki WordPress customizer plugin (all versions before 6.2.3) allows
SQL injection in the Kirki WordPress plugin (versions 6.0.0 through <6.3.0) enables authenticated users with editor-leve
Unauthenticated shortcode injection in Kirki WordPress plugin (all versions before 6.2.1) allows any remote attacker to
Object injection in the Themeum Kirki WordPress customizer framework (all versions through 6.0.12) allows attackers to a
Kirki WordPress Customizer Framework plugin before 6.0.14 exposes registered user email addresses, comment author emails
Unauthenticated content disclosure in the Kirki WordPress plugin before 6.3.0 allows any remote attacker to retrieve the
Unauthenticated comment manipulation in the Kirki WordPress plugin (versions before 6.0.12) allows remote attackers to o
Blind SQL injection in the Themeum Kirki WordPress customizer framework (all versions up to and including 6.0.12) lets r
HTML injection in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to embed arbitrary HTML into
Share
External POC / Exploit Code
Leaving vuln.today