Security Alert Summary
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is affected by a Blind Server-Side Request Forgery (SSRF) vulnerability via the kirki_data parameter in versions up to and including 6.2.0. An unauthenticated attacker could cause the web application to make requests to arbitrary locations, which may allow querying or modifying information on internal services.
CVE Details
- CVE ID: CVE-2026-18335
- Affected component: Kirki – Freeform Page Builder, Website Builder & Customizer (plugin)
- Affected versions: All versions up to and including 6.2.0
- Published: September 24, 2026 at 10:17:37 AM UTC
- Last modified: September 24, 2026 at 4:17:07 PM UTC
- CVSS v3.1 base score: 5.4
- CVSS v3.1 severity: MEDIUM
- CVSS v3.1 vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Authentication / privileges / user interaction: No authentication or privileges required; no user interaction required (PR:N, UI:N)
- Primary impacts: Confidentiality – Low; Integrity – Low; Availability – None
- CWE / weakness: CWE-918 (Server-Side Request Forgery)
Technical Details
The vulnerability is a Blind Server-Side Request Forgery (SSRF) present in the plugin via the kirki_data parameter. When the vulnerable parameter is processed by the application, an attacker can cause the application to initiate HTTP requests to arbitrary locations from the server. The CVE description indicates these requests can be used to query and modify information on internal services.
Because this is described as a blind SSRF, the attacker may not directly receive the response body from those internal requests, but the server will still perform the requested network interactions. The issue exists due to insufficient validation or restriction of destinations for requests issued as a result of input provided in the kirki_data parameter.
How This Could Impact Your Website
In a realistic scenario, a site owner maintains the site, internal staff manage content, and an external contractor or contributor uploads or interacts with site features. An unauthenticated attacker could leverage this vulnerability to make the site server query internal services that are otherwise inaccessible from the public internet. That could lead to disclosure or modification of data held by internal services, which in turn may expose internal endpoints, metadata, or configuration details.
Practical consequences include increased risk of targeted phishing or social engineering if internal addresses or service information are discovered, and limited integrity impact if internal endpoints that accept requests are modified. The vulnerability does not indicate direct impact to site availability according to the CVSS data.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other roles with content submission capabilities.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual behavior or unexpected outgoing requests from the web server.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
