Kirki Page Builder EUVD-2026-85838

No authentication or user interaction required - remote unauthenticated exploitation is possible against default configurations of any WordPress site running Kirki - Freeform Page Builder <=6.2.0, by supplying an attacker-controlled URL in the 'kirki_data' parameter. Realistic exploitation is LIMITED by the blind nature of the SSRF (AC:H): no response body is returned to the attacker, so meaningful impact requires prior knowledge of reachable internal hosts/services and behaviors that can be inferred out-of-band or through state changes. Value is highest where the server can reach sensitive internal services or cloud instance-metadata endpoints.

This is a moderate-risk, not top-priority, vulnerability. The Wordfence-assigned CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N = 5.4) shows an attractive access profile - network-reachable and fully unauthenticated (PR:N/UI:N) - which favors opportunistic scanning against exposed WordPress sites. Two factors temper this: AC:H reflects that this is a BLIND SSRF (no response returned to the attacker, so success depends on knowing/guessing reachable internal endpoints and useful behaviors), and impacts are only C:L/I:L with A:N. The scope change (S:C) is justified because the request originates from the web app to distinct internal services. No EPSS score, KEV listing, or public POC is present in the provided data - so there is no evidence of active exploitation or automated weaponization; treat exploitation status as 'no public exploit identified at time of analysis.' A patch exists (wp.org trac changeset 3636487), which raises the value of prompt patching over emergency response. Net: a real internal-network-pivot/SSRF concern worth patching in normal cycles, especially for sites with sensitive internal services or cloud metadata endpoints, but not a drop-everything issue on raw signals alone.

An unauthenticated attacker sends a crafted request to a vulnerable WordPress site supplying an attacker-controlled URL in the 'kirki_data' parameter, causing the server to issue a request to an internal target (e.g., an internal admin panel, database service, or cloud metadata endpoint). Because the SSRF is blind, the attacker cannot read responses directly and instead infers results from timing, side effects, or state changes to query and modify internal services. No public exploit code is identified in the provided data, and the high attack complexity means the attacker must already understand the internal topology to derive value.