Executive brief
The Kirki plugin for WordPress, which provides a framework for theme developers to create customization options, contains a security flaw that allows unauthorized users to force the website to make outgoing web requests. An attacker can use this to probe internal network services that are not normally accessible from the internet or to hide their identity when attacking other systems. This could lead to the exposure of sensitive internal configuration data or cloud metadata.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the Kirki WordPress plugin due to insufficient validation of the 'elementUrl' parameter within the 'kirki_get_apis' AJAX action. An unauthenticated attacker can retrieve a public REST API nonce from the front-end and then use it to trigger the 'get-pre-built-html' endpoint. Because the plugin uses 'wp_remote_get' without adequate restrictions, an attacker can force the server to issue HTTP requests to arbitrary internal or external hosts, including loopback addresses (127.0.0.1), private network ranges (RFC1918), and cloud metadata services (169.254.169.254). The vulnerability is primarily blind, though response reflection may occur if the target returns specific Kirki-formatted JSON. The issue is fixed in version 6.0.12.
Affected products
- Kirki Kirki < 6.0.12
Timeline
- 2026-06-29: disclosed: Initial public disclosure by WPScan
- 2026-06-29: patched: Patch released in version 6.0.12
- 2026-07-20: advisory: CVE published to NVD