External risk intelligence

Kirki WordPress Plugin Server-Side Request Forgery

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-13147

The vulnerability affects a WordPress plugin, which is typically deployed as part of public-facing web applications. Because the plugin functionality is exposed via the web server to process user-supplied URLs, it is commonly reachable from the public internet in standard WordPress deployments.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Kirki WordPress plugin that could allow attackers to trick your website into sending requests to external servers. This type of attack, known as Server-Side Request Forgery, can potentially lead to unauthorized access or manipulation of your web infrastructure. The main concern is to confirm if this plugin is in use and assess any exposure.

Website plugin allows unauthorized external requests.
Potential for unauthorized access to your web infrastructure.
Verify usage and assess exposure of this plugin.

Attack Path

How an attacker could exploit the issue

An attacker can leverage this vulnerability by sending a specially crafted request to a WordPress site using the vulnerable plugin. Since no authentication is required, the attacker can cause the website to send an HTTP request to any host they choose. This could lead to unauthorized access to internal resources or manipulation of external services, depending on the attacker's intent and the site's configuration.

No authentication required.
Server processes supplied URLs.
Risk of unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to trick the affected website into making arbitrary HTTP requests to external servers. This server-side request forgery could potentially expose internal network resources or interact with services on behalf of the vulnerable site when supported by the advisory's context.

Website's ability to make external requests.
Sending malicious URLs to the plugin.
Internal network access or service interaction.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Kirki WordPress plugin's Server-Side Request Forgery vulnerability requires immediate attention from teams managing WordPress sites. The first step is to identify all instances of the plugin, confirm their internet reachability, and then assess business criticality to prioritize remediation efforts. Coordination with vendor-management may be necessary if the plugin is included in a managed service.

WordPress site owners and platform teams own this issue.
Verify plugin reachability and business criticality.
Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Kirki WordPress plugin?

Kirki is a developer-focused toolkit for WordPress used to create custom themes and manage theme options. It provides an abstraction layer that simplifies how developers integrate features like color pickers, typography settings, and other design controls into the WordPress Customizer. Because it is embedded within themes, it often operates automatically whenever a site's design settings are loaded.

How does CVE-2026-13147 cause Server-Side Request Forgery?

This vulnerability stems from improper input validation. When software accepts a URL from a user without checking it, it can be tricked into fetching data from a location the developer did not intend. In this case, the plugin acts as a proxy, sending HTTP requests on behalf of the web server to arbitrary addresses chosen by an attacker, rather than limiting requests to trusted or expected destinations.

Can I trigger this vulnerability if I am not logged into the site?

Yes, this bug does not require authentication to trigger. An attacker can send a specially crafted request to your server from the public internet. However, simply visiting the site or viewing pages does not trigger it; the request must specifically target the plugin's URL-processing function to force the server to initiate an unauthorized connection.

Is my site at risk according to Halo Surface Signal?

Yes, Halo Surface Signal flags this as a likely risk because Kirki is typically deployed on public-facing web applications. Since the plugin's functionality is accessible through the web server to process user-supplied input, it is generally reachable from the public internet, making it easier for an attacker to interact with the plugin without needing local network access.

What should I do to address this Kirki vulnerability?

Your first step is to verify if your WordPress environment includes the Kirki plugin and confirm which version is installed. If you are running a version before 6.0.12, prioritize updating the plugin immediately. If the plugin is bundled within a specific theme, check if a theme update is available from the developer that includes the patched version of Kirki.

References

wpscan.com/vulnerability/f39c3e35-8673-4095-a829-a9ec2624f66c/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.