CVE-2026-84224CWE-918ssrf

CVE-2026-84224

Medium · published October 9, 2026

CVSS v3.1
4.1
EPSS
0%
Percentile
7.1
In the wild
Unconfirmed
What it is

The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00179 · 7.1th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-10-09T13:17Z
References (1)
https://wpscan.com/vulnerability/6a2455dd-8da9-4c7e-a249-3c694cf2983e/ · [email protected]
EPSS history
Timeline
  • 10 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 09 OCT 08:06Z
    Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL
    cvelistv5
  • 09 OCT 08:06Z
    Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL
    cvelistv5