CVE-2026-13147: Kirki WordPress Plugin SSRF Vulnerability

CVE-2026-13147 Overview

The Kirki WordPress plugin before version 6.0.12 contains a Server-Side Request Forgery (SSRF) vulnerability. The plugin fails to validate user-supplied URLs before issuing server-side HTTP requests. Unauthenticated attackers can force the affected site to send arbitrary HTTP requests to hosts of their choosing. This includes internal network resources normally shielded from external access, cloud metadata endpoints, and other back-end services.

Critical Impact
Unauthenticated attackers can pivot through vulnerable WordPress sites to reach internal services, exfiltrate sensitive data from cloud metadata endpoints, and probe internal networks without authentication.

Affected Products

Kirki WordPress plugin versions prior to 6.0.12
WordPress sites with the Kirki Customizer Framework installed
Themes that bundle vulnerable Kirki versions as a dependency

Discovery Timeline

2026-07-20 - CVE-2026-13147 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-13147

Vulnerability Analysis

The Kirki plugin provides a customizer framework for WordPress themes. Prior to version 6.0.12, one of its server-side handlers accepts a URL parameter and issues an outbound HTTP request without validating the destination. Because the endpoint does not require authentication, remote attackers can invoke it directly.

The request originates from the WordPress server itself. This gives attackers access to resources reachable from the server's network position, including services bound to localhost, private RFC1918 ranges, and cloud provider metadata services such as http://169.254.169.254/. Attackers can use SSRF to enumerate internal services, retrieve cloud instance credentials, or bypass IP-based access controls on internal APIs.

Root Cause

The root cause is missing URL validation before the plugin performs a server-side HTTP request. The handler does not enforce an allowlist of destinations, does not block private IP ranges, and does not verify that the requested URL belongs to an expected host. This maps to CWE-918: Server-Side Request Forgery.

Attack Vector

An attacker sends a crafted HTTP request to the vulnerable Kirki endpoint with a URL parameter pointing to an internal or attacker-controlled resource. No authentication is required. The WordPress server fetches the specified URL and, depending on the code path, may return the response body to the attacker. Attackers can chain SSRF with cloud metadata abuse to steal IAM credentials from AWS, Azure, or GCP instances hosting the WordPress site.

Refer to the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-13147

Indicators of Compromise

Outbound HTTP requests from the WordPress server to internal IP ranges such as 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16
Requests from the web server process to cloud metadata endpoints such as 169.254.169.254
Unusual PHP-initiated connections to localhost on non-standard ports
Access log entries targeting Kirki plugin endpoints with URL parameters containing internal hostnames

Detection Strategies

Inspect web server access logs for unauthenticated requests to Kirki plugin paths containing url= or similar parameters referencing IP addresses
Correlate inbound requests to Kirki endpoints with subsequent outbound connections from the PHP worker process
Deploy web application firewall rules that flag requests to plugin endpoints referencing private IP ranges or the cloud metadata address

Monitoring Recommendations

Monitor egress traffic from web servers and alert on connections to 169.254.169.254 and private CIDR ranges
Track the installed version of the Kirki plugin across managed WordPress hosts and flag versions below 6.0.12
Enable verbose logging on the WordPress site for plugin AJAX and REST endpoints to preserve forensic evidence

How to Mitigate CVE-2026-13147

Immediate Actions Required

Update the Kirki plugin to version 6.0.12 or later on all WordPress installations
Audit installed themes for bundled Kirki libraries and update or replace vulnerable copies
Review web server logs for prior SSRF attempts targeting Kirki endpoints and investigate any suspicious outbound requests
Rotate any cloud instance credentials if metadata service access from the WordPress host cannot be ruled out

Patch Information

Upgrade to Kirki version 6.0.12 or later. The fixed release adds validation of user-supplied URLs before the plugin issues server-side HTTP requests. See the WPScan Vulnerability Report for the vendor reference.

Workarounds

Restrict access to Kirki plugin endpoints at the reverse proxy or web application firewall until patching is complete
Enforce IMDSv2 on AWS instances to require session tokens for metadata access, reducing SSRF impact
Apply egress firewall rules on the WordPress host that block outbound connections to private IP ranges and cloud metadata addresses
Disable or remove the Kirki plugin if it is not actively required by the site's theme

bash

# Example egress restriction using iptables to block metadata access from the web server user
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT