CVE-2026-13147
Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis
CVSS Score
9.1
EPSS Score
0.0%
EPSS Percentile
0th
The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).
| Vendor | unknown |
| Product | kirki |
| Published | Jul 20, 2026 |
| Last Updated | Jul 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown kirki
Be the first to know when new critical vulnerabilities affecting unknown kirki are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Kirki
0 < 6.0.12
References
Credits
Emirhan Kurt WPScan