Kirki accepts unauthenticated server-side request targets
An unauthenticated attacker can supply kirki_data that causes the application to make requests to arbitrary destinations, including internal services. This is blind SSRF: the export does not establish direct access to response bodies. The endpoint, request-building function and exact request constraints are unspecified; effects on an internal service depend on what it accepts. Affected versions: <= 6.2.0. Confirmed fixed release: 6.2.1.
- Component
- Kirki – Freeform Page Builder, Website Builder & Customizer
- Plugin slug
kirki- Affected
- <= 6.2.0
- Safe version
6.2.1- Published
- Sep 24, 2026
This CVE was published Sep 24, 2026 and is one of 42 known issues for this plugin.
Update, patch or deactivate.
Update to 6.2.1 or later, preferably the current supported release. Validate destinations before every server-side request, restrict schemes and hosts, and reject private or loopback destinations and unsafe redirects. Remove unnecessary externally controlled fetch behavior. The official changelog matches this fix in 6.2.1. Official changelog: https://wordpress.org/plugins/kirki/#developers
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N