CVE-2026-18335 in Kirki Plugin
Summary
by MITRE • 09/24/2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in Kirki – Freeform Page Builder, Website Builder & Customizer affects all versions up to and including 6.2.0. This plugin is widely utilized by WordPress administrators to customize themes and build pages without extensive coding knowledge. The core issue lies within the handling of the kirki_data parameter, which serves as a conduit for server-side operations during theme customization processes. Because this functionality does not enforce sufficient validation on user-supplied input prior to processing, it creates an opening for malicious actors to exploit the application's trust in its own internal request mechanisms. This flaw allows external users to manipulate how the WordPress environment interacts with other services, fundamentally breaking the principle of least privilege by granting unauthenticated entities control over outbound network traffic initiated by the server itself.
From a technical perspective, this vulnerability is classified as a Blind Server-Side Request Forgery, commonly abbreviated as SSRF. In an SSRF attack, an attacker induces a web application to make HTTP requests to a destination that they did not intend. The term blind indicates that the response from the requested URL is not directly returned to the attacker in the initial request cycle, requiring more sophisticated exploitation techniques such as out-of-band data exfiltration or timing-based analysis to confirm successful execution. By leveraging the kirki_data parameter, an unauthenticated user can craft specific payloads that force the WordPress server to connect to arbitrary internal IP addresses and ports. This capability effectively bypasses network perimeter defenses because the traffic originates from a trusted source within the protected environment, often allowing access to services that are not exposed to the public internet but remain accessible via local host or private network interfaces.
The operational impact of this vulnerability is severe due to its potential for lateral movement and data exfiltration. Attackers can utilize this flaw to probe internal infrastructure, identifying running services such as databases, administrative panels, cloud metadata endpoints, or other microservices that reside behind firewalls but are reachable from the web server's network interface. For instance, accessing cloud provider metadata services like AWS EC2 Instance Metadata Service is a common objective in SSRF exploits, potentially leading to the compromise of IAM credentials and full control over cloud resources. Furthermore, attackers may attempt to interact with internal database ports or application interfaces that lack authentication mechanisms when accessed from localhost. This can result in unauthorized data retrieval, modification of critical system configurations, or even remote code execution if combined with other vulnerabilities within those internal services.
This vulnerability aligns closely with CWE-918, which defines Server-Side Request Forgery as a weakness where the web server receives a URL or similar request from an upstream component and retrieves the results without validating them to ensure they are directed at the expected service. Additionally, in terms of offensive security frameworks, this exploit maps directly to MITRE ATT&CK technique T1571, which covers Non-Standard Ports for Command and Control, as well as T1046, Network Service Discovery, where adversaries use internal services to map out the network topology. The lack of authentication required to trigger this flaw further exacerbates the risk profile, classifying it under CWE-306, Missing Authentication for Critical Function, because a critical function that modifies server behavior is accessible without any form of user verification or authorization checks.
To mitigate this vulnerability, immediate action should be taken by updating the Kirki plugin to version 6.2.1 or later, where these input validation issues have been addressed. Administrators who cannot immediately update should implement compensating controls such as web application firewall rules that restrict outbound connections from the WordPress server to only known and necessary destinations. It is also advisable to isolate the database and other internal services on private subnets with strict access control lists that deny traffic originating from the public-facing web tier unless explicitly permitted for specific, whitelisted operations. Regular security audits and penetration testing focused on SSRF vectors are recommended to ensure no similar flaws exist in other plugins or custom code within the WordPress environment.