CVE-2026-84224: Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL
The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs editor-level access or higher in WordPress. Unauthenticated visitors and users below the editor role are not identified as able to exploit it.
What systems are at risk from the server-side requests?
Internal services that are reachable from the WordPress site's server but not otherwise exposed may be targeted. The attacker can use responses to determine which internal services are live.
What should be checked to determine exposure?
Check whether the site uses the Kirki plugin and whether its version is earlier than 6.3.2. Also review whether editor or higher privileges are assigned to untrusted users.