CVE-2026-84224 Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL
Editors can exploit unvalidated remote template URLs to perform Server-Side Request Forgery, accessing internal services and probing network availability.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-84224?
CVE-2026-84224 is a medium-severity server-side request forgery vulnerability in Unknown Kirki, published on 9 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.
Weakness: CWE-918
Which versions are affected by CVE-2026-84224?
How do I fix CVE-2026-84224?
No fix has been published for CVE-2026-84224 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-84224 being exploited?
There is no known exploitation of CVE-2026-84224 in the wild and no public exploit code.
Sources
Also known as GHSA-w2rx-5q64-f3mg.