Medium severity5.4NVD Advisory· Published Sep 24, 2026

CVE-2026-18335

Description

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Affected products

WordPress/Kirki – Freeform Page Builder, Website Builder & Customizerllm-fuzzy
Range: <=6.2.0
WordPress/Kirkillm-fuzzy
Range: <=6.2.0
Package: https://wordpress.org/plugins/kirki

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3636487/nvd
www.wordfence.com/threat-intel/vulnerabilities/id/461be8a5-bf72-4028-88e6-bf6544120ac6nvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000