EUVD-2026-45889
GHSA-74x7-v2vc-6vgc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network SSRF with no interaction (AV:N/AC:L/PR:N/UI:N); high confidentiality from internal data access, but integrity only limited (I:L) absent a confirmed state-changing sink.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).
Articles & Coverage 2
AnalysisAI
Server-Side Request Forgery in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to coerce the server into issuing HTTP requests to arbitrary attacker-chosen hosts because a user-supplied URL is fetched server-side without validation. This is reachable remotely with no authentication or user interaction (CVSS 9.1), publicly available exploit code exists, and a vendor patch has shipped, but there is no public exploit identified as being used in active attacks (not in CISA KEV). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerable code path is the Kirki server-side URL-fetch feature that requests a user-supplied URL without validation; exploitation requires only that a site runs Kirki before 6.0.12 with that endpoint reachable, and per the CVSS PR:N/UI:N no authentication or user interaction is needed - no special non-default configuration is indicated in the description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are consistent and point to a real, high-priority issue rather than an inflated CVSS: the vector AV:N/AC:L/PR:N/UI:N describes trivial, unauthenticated, network-reachable exploitation, and publicly available exploit code lowers the barrier further. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a crafted unauthenticated HTTP request to the vulnerable Kirki endpoint with a URL parameter pointing at an internal service such as a cloud metadata endpoint (e.g., 169.254.169.254) or an intranet admin panel, and the WordPress server dutifully issues the request and can return or act on the response. Because publicly available exploit code exists and the CVSS vector is AV:N/AC:L/PR:N/UI:N, this can be automated at scale against exposed sites with no authentication and no user interaction. |
| Remediation | Upgrade the Kirki plugin to version 6.0.12 or later, which is the vendor-released patch that adds validation of the user-supplied URL before the server-side request. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations to identify those running Kirki versions prior to 6.0.12 and classify them as critical priority. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbit
PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users
Object injection in the Themeum Kirki WordPress customizer framework (all versions through 6.0.12) allows attackers to a
Unauthenticated comment manipulation in the Kirki WordPress plugin (versions before 6.0.12) allows remote attackers to o
Blind SQL injection in the Themeum Kirki WordPress customizer framework (all versions up to and including 6.0.12) lets r
HTML injection in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to embed arbitrary HTML into
Broken access control in the Themeum Kirki WordPress customizer framework (versions up to and including 6.0.13) allows r
Stored cross-site scripting in the Themeum Kirki WordPress customizer framework (versions through 6.0.11) lets an attack
We need to produce a JSON object with specified fields. Let's gather the data: CVE-2026-65436, description: Editor Arbit
Unauthenticated IDOR in the Kirki WordPress customizer toolkit (versions <= 6.0.11) allows remote unauthenticated attack
Share
External POC / Exploit Code
Leaving vuln.today