CVE-2026-13147: Kirki WordPress Plugin SSRF Allows Unauthenticated Internal Network Scanning

Executive Summary

A CVSS 9.1 High server-side request forgery (SSRF) vulnerability (CVE-2026-13147) has been identified in the Kirki Customizer Framework WordPress plugin. Prior to version 6.0.12, the plugin fails to validate user-supplied URLs before making server-side HTTP requests, allowing unauthenticated attackers to force the WordPress server to contact arbitrary internal or external hosts.

This class of vulnerability can be leveraged for internal network reconnaissance, cloud metadata theft, and in some configurations, full server compromise.

Vulnerability Overview

What Is Kirki?

Kirki is a widely used WordPress developer toolkit that extends the WordPress Customizer with advanced field types (color pickers, typography controls, sliders, etc.). It simplifies theme development and is used by thousands of WordPress themes and plugins.

Technical Details

The vulnerability exists in a URL-fetching feature within Kirki. The plugin accepts a URL parameter from unauthenticated HTTP requests and passes it directly to a server-side HTTP client (WordPress's wp_remote_get() or similar) without validating that the target is a legitimate external resource.

Attack Scenarios

Scenario 1: Cloud Metadata Exfiltration (AWS/GCP/Azure)

1. Attacker sends request to vulnerable Kirki endpoint with URL:
   http://169.254.169.254/latest/meta-data/iam/security-credentials/
2. WordPress server fetches AWS IMDS metadata
3. Response containing IAM role credentials returned to attacker
4. Attacker uses credentials to pivot into AWS environment

Scenario 2: Internal Network Scanning

1. Attacker iterates over internal IP ranges:
   http://10.0.0.1/, http://10.0.0.2/, etc.
2. Response timing and content differences reveal live internal hosts
3. Attacker maps internal services (databases, admin panels, APIs)
4. Further exploitation of discovered services

Scenario 3: Localhost Service Abuse

1. Attacker targets services bound to localhost:
   http://127.0.0.1:6379/ (Redis)
   http://127.0.0.1:11211/ (Memcached)
2. Unauthenticated access to internal services
3. Cache poisoning, data exfiltration, or command injection via protocol abuse

Affected Versions

Remediation

Update the Plugin

Update Kirki to version 6.0.12 or later immediately.

# Via WP-CLI
wp plugin update kirki
 
# Verify installed version
wp plugin get kirki --field=version

Or update through WordPress admin: Plugins > Installed Plugins > Kirki > Update Now.

Block SSRF at Infrastructure Level

Even after patching, implement defense-in-depth controls:

# Block outbound requests to cloud metadata endpoints at the firewall/network level
# AWS: 169.254.169.254
# GCP: 169.254.169.254 / metadata.google.internal
# Azure: 169.254.169.254

AWS-specific: Enable IMDSv2 (token-required metadata service), which requires a PUT request before GET and mitigates many SSRF-to-metadata attacks:

# Require IMDSv2 on EC2 instances
aws ec2 modify-instance-metadata-options \
  --instance-id <instance-id> \
  --http-tokens required \
  --http-endpoint enabled

WordPress-Level Mitigation

// Add to wp-config.php or a must-use plugin to block internal IP access
add_filter('http_request_host_is_external', function($is_external, $host) {
    $blocked = ['169.254.169.254', '127.0.0.1', '::1', 'localhost'];
    if (in_array($host, $blocked)) return false;
    // Also block RFC1918 private ranges
    $ip = gethostbyname($host);
    if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) {
        return false;
    }
    return $is_external;
}, 10, 2);

Detection

Broader Context

SSRF vulnerabilities in WordPress plugins are among the most impactful web vulnerabilities in shared-hosting and cloud-hosted WordPress environments. A single SSRF flaw in a widely installed plugin can lead to:

• Cloud credential theft via metadata services (AWS IMDS, GCP metadata API)
• Internal service exposure in containerized or microservices environments
• Bypass of firewall rules that trust the web server

With Kirki's wide adoption in WordPress themes, this vulnerability has a large blast radius even without widespread exploitation tooling.

References

• NVD — CVE-2026-13147
• Kirki Plugin on WordPress.org
• OWASP SSRF Prevention Cheat Sheet
• AWS IMDSv2 Documentation

Related Reading

• CVE-2026-44359: Meshtastic CI/CD Workflow Exposes Repository Secrets
• CVE-2026-16235: Perl Crypt::Password Weak Salt Generation
• WPvivid Backup Plugin Critical RCE