Is CVE-2026-13147 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-13147?

CVE-2026-13147 has a CVSS v3 severity of CRITICAL (9.1).

Back

CVE-2026-13147

Description

The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).