CVE-2026-84224
Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL
CVSS Score
4.1
EPSS Score
0.0%
EPSS Percentile
0th
The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.
| Vendor | unknown |
| Product | kirki |
| Published | Oct 9, 2026 |
| Last Updated | Oct 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown kirki
Be the first to know when new medium vulnerabilities affecting unknown kirki are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / Kirki
0 < 6.3.2
References
Credits
Mohammed Abd Alrahman WPScan