CVE-2026-13147

Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis

9.1 Critical

The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

1.47%Up 1.3 points since Jul 20, 2026

What each source reports

CVE List Score used 9.1

Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis

Record: CVE-2026-13147
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

EUVDEUVD-2026-45889 9.1

Record: EUVD-2026-45889
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-74x7-v2vc-6vgc 9.1

The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting...

Record: GHSA-74x7-v2vc-6vgc
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

NVD 9.1

Record: CVE-2026-13147
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Nuclei	WordPress Kirki < 6.0.12 - Server-Side Request Forgery

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, Nuclei, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-13147 is a critical vulnerability (CVSS 9.1) in Themeum Kirki, published July 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.47%, the 73rd percentile. No source names a fixed version.