CVE-2026-13147

15th percentile - higher than 15% of all known CVEs

The Kirki WordPress plugin before version 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).

An attacker can exploit this vulnerability to scan the organization's internal network, access sensitive services, or launch attacks on other systems, potentially leading to data leakage or infrastructure compromise.

Immediately update the Kirki plugin to version 6.0.12 or later, which includes a fix that validates URLs before making server-side requests.