Junglewise Threat Intelligence

CVE-2026-12095: bytuncay Kargo Takip SSRF in api_url parameter

CVE-2026-12095 · Severity: high · CVSS 7.2 · Published 2026-06-24

Executive brief

The Kargo Takip plugin for WordPress, used for shipment tracking, contains a security flaw that allows unauthorized individuals to force the website to make requests to internal or external servers. This could allow an attacker to bypass firewalls and access sensitive internal data, such as cloud server credentials or private network information. Because the plugin displays parts of the retrieved data back to the attacker, it poses a direct risk of data theft from the organization's internal infrastructure.

Technical details

The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via the 'api_url' parameter in the 'decodeandview.php' file. This vulnerability exists because the application does not properly validate or restrict the destination of web requests initiated by the server. An unauthenticated attacker can provide a malicious URL to the 'api_url' parameter, causing the server to make requests to arbitrary locations, including internal services or cloud metadata endpoints (e.g., 169.254.169.254). Furthermore, the script parses JSON responses and echoes the value of any 'auth' key back to the browser, facilitating the direct exfiltration of sensitive internal information. All versions up to and including 1.2 are affected.

Affected products

  • bytuncay Kargo Takip <= 1.2

Timeline

  • 2026-06-24: disclosed: CVE published by Wordfence and NVD

References