WordPress Kirki < 6.0.12 - Server-Side Request Forgery
CVE-2026-13147
Verified
Description
Kirki WordPress plugin < 6.0.12 contains a server-side request forgery caused by lack of URL validation, letting unauthenticated attackers make the site issue HTTP requests to arbitrary hosts, exploit requires no authentication.
Severity
High
CVSS Score
5.3
Exploit Probability
1%
Affected Product
kirki
Published Date
July 30, 2026
Template Author
0x_akoko
CVE-2026-13147.yaml
5.3Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE ID:
cve-2026-13147
CWE ID:
cwe-918
Remediation Steps
Update to version 6.0.12 or later.