CVE-2026-13147 Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis
Unauthenticated attackers can force the WordPress site to make arbitrary HTTP requests, potentially accessing internal resources or bypassing network restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-13147?
CVE-2026-13147 is a critical server-side request forgery vulnerability in Unknown Kirki, published on 20 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).
Which versions are affected by CVE-2026-13147?
How do I fix CVE-2026-13147?
No fix has been published for CVE-2026-13147 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-13147 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-13147 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-74x7-v2vc-6vgc.