Quick answers
- Is CVE-2026-13147 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-13147 being exploited in the wild.
- How severe is CVE-2026-13147?
- Informational severity, with a CVSS score of 0, published 20 July 2026.
- Which products and versions are affected?
- Kirki Framework Kirki Customizer Framework < 6.0.12.
- Is there a fix for CVE-2026-13147?
- A patch was published on 2026-06-29: Patch released in version 6.0.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-13147 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-13147?
- Check whether you run Kirki Framework Kirki Customizer Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the Kirki WordPress plugin due to insufficient validation of the 'elementUrl' parameter within the 'kirki_get_apis' AJAX action. An unauthenticated attacker can retrieve a public REST API nonce from the front-end and then use it to trigger the 'get-pre-built-html' endpoint. Because the plugin uses 'wp_remote_get' without adequate restrictions, an attacker can force the server to issue HTTP requests to arbitrary internal or external hosts, including loopback addresses (127.0.0.1), private network ranges (RFC1918), and cloud metadata services (169.254.169.254). The vulnerability is primarily blind, though response reflection may occur if the target returns specific Kirki-formatted JSON. The issue is fixed in version 6.0.12.
Affected products
- Kirki Kirki < 6.0.12
Timeline
- 2026-06-29: disclosed: Initial public disclosure by WPScan
- 2026-06-29: patched: Patch released in version 6.0.12
- 2026-07-20: advisory: CVE published to NVD