CVE-2026-57627: Kirki Subscriber SSRF Vulnerability

CVE-2026-57627 Overview

CVE-2026-57627 is a Server-Side Request Forgery (SSRF) vulnerability affecting the Kirki WordPress plugin in versions up to and including 6.0.11. The flaw is classified under CWE-918: Server-Side Request Forgery. An authenticated attacker with Subscriber-level privileges can coerce the vulnerable WordPress site to issue HTTP requests to attacker-controlled or internal destinations. The vulnerability carries a CVSS 3.1 score of 4.9 with a scope change, meaning exploitation can affect resources beyond the vulnerable component.

Critical Impact
A low-privileged Subscriber account can leverage the WordPress server to reach internal network resources, cloud metadata services, or arbitrary external hosts.

Affected Products

Kirki WordPress plugin versions <= 6.0.11
WordPress sites permitting Subscriber-level registration with Kirki installed
Any WordPress deployment using Kirki for customizer controls without the fixed release

Discovery Timeline

2026-06-26 - CVE-2026-57627 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-57627

Vulnerability Analysis

The Kirki plugin provides a framework for building WordPress Customizer controls, including remote resources such as Google Fonts and remote images. The SSRF weakness stems from a plugin endpoint that accepts a user-supplied URL and issues a server-side HTTP request without adequate destination validation. Because the flaw requires only Subscriber privileges, any registered site user can invoke the vulnerable code path.

SSRF conditions like this allow attackers to pivot from the public web tier into environments the outbound-request initiator can reach. On cloud-hosted WordPress instances, that commonly includes the Instance Metadata Service (IMDS) at 169.254.169.254, internal admin panels, databases bound to loopback, and neighboring services. Response data is limited (confidentiality impact is Low), but attackers can still confirm reachability, enumerate internal services, and in some configurations retrieve short response fragments.

Attack complexity is rated High because successful exploitation typically depends on network topology, the target's cloud metadata configuration, and the presence of internally reachable services. The EPSS probability is 0.18%.

Root Cause

The root cause is missing or insufficient validation of a URL parameter processed by a Kirki AJAX or REST endpoint that is available to authenticated users. The plugin dispatches an HTTP request using WordPress HTTP APIs against the supplied host without enforcing an allowlist, blocking private IP ranges, or restricting redirects to prevent DNS rebinding.

Attack Vector

Exploitation requires network access to the WordPress site and a valid Subscriber account. The attacker authenticates, invokes the affected Kirki endpoint, and supplies a URL pointing to an internal service, cloud metadata endpoint, or attacker-controlled callback. The server issues the outbound request under its own identity, satisfying any IP-based trust the internal target may extend. Refer to the Patchstack Vulnerability Report for the technical write-up.

Detection Methods for CVE-2026-57627

Indicators of Compromise

Outbound HTTP requests from the WordPress PHP worker to RFC1918 addresses, 127.0.0.1, or 169.254.169.254
Access log entries showing Subscriber-authenticated calls to Kirki admin-ajax.php or REST endpoints with URL parameters
Unexpected DNS resolutions initiated by the web server for attacker-controlled domains
Spikes in Subscriber account registration followed by AJAX activity targeting the Kirki plugin

Detection Strategies

Inspect web server and PHP error_log output for outbound HTTP calls originating from wp-content/plugins/kirki/
Correlate authenticated Subscriber sessions with outbound network requests using SIEM rules
Deploy egress filtering telemetry that flags WordPress hosts contacting private IP ranges or cloud metadata IPs

Monitoring Recommendations

Alert on any WordPress origin traffic to 169.254.169.254, link-local, or internal management subnets
Monitor Kirki plugin version inventory across managed WordPress sites and flag installations at or below 6.0.11
Track anomalous request volume to /wp-admin/admin-ajax.php from low-privilege accounts

How to Mitigate CVE-2026-57627

Immediate Actions Required

Upgrade the Kirki plugin to a version above 6.0.11 once the vendor releases a patched build
Audit Subscriber-level accounts and disable open user registration where it is not required
Apply egress filtering on WordPress hosts to block requests to internal ranges and cloud metadata endpoints

Patch Information

Refer to the Patchstack advisory for the fixed version identifier and remediation guidance. Administrators should update Kirki through the WordPress plugin manager or via WP-CLI once the patched release is available.

Workarounds

Restrict WordPress user registration and set the default role to a value that does not enable Kirki AJAX endpoints where feasible
Enforce IMDSv2 on AWS instances so metadata service access requires session tokens unavailable via SSRF
Place the WordPress host behind an outbound proxy that denies requests to private and link-local address space
Remove or disable the Kirki plugin until a fixed release is installed if the customizer framework is not in active use

bash

# Example nginx egress control via iptables on the WordPress host
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT