{"id":"CVE-2026-84224","aliases":["EUVD-2026-95577","GHSA-w2rx-5q64-f3mg"],"status":"published","title":"Kirki \u003c 6.3.2 - Editor+ Blind SSRF via Remote Template URL","description":"The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.","severity":{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00179,"percentile":0.07544,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2026-10-09T08:06:47Z","modified":"2026-10-09T15:31:29Z","products":[{"vendor":"themeum","product":"kirki"},{"vendor":"unknown","product":"kirki"}],"references":[{"url":"https://wpscan.com/vulnerability/6a2455dd-8da9-4c7e-a249-3c694cf2983e/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84224"},{"url":"https://wpscan.com/vulnerability/6a2455dd-8da9-4c7e-a249-3c694cf2983e"},{"url":"https://github.com/advisories/GHSA-w2rx-5q64-f3mg"}],"sources":{"cve":[{"id":"CVE-2026-84224","title":"Kirki \u003c 6.3.2 - Editor+ Blind SSRF via Remote Template URL","description":"The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.","status":"published","published":"2026-10-09T08:06:47.993Z","modified":"2026-10-09T15:00:19.518Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:20:08.391556Z"}],"euvd":[{"id":"EUVD-2026-95577","description":"The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.","status":"published","published":"2026-10-09T08:06:47Z","modified":"2026-10-09T15:00:19Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:25.010362Z"}],"ghsa":[{"id":"GHSA-w2rx-5q64-f3mg","title":"The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before...","description":"The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.","status":"published","published":"2026-10-09T09:31:06Z","modified":"2026-10-09T15:31:29Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:13:00.589729Z"}],"nvd":[{"id":"CVE-2026-84224","description":"The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.","status":"published","published":"2026-10-09T09:17:10Z","modified":"2026-10-09T15:17:17.39Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:55.473789Z"}]}}