CVE-2026-18335— Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter
Quick assessment
Affected
themeum Kirki – Freeform Page Builder, Website Builder & Customizer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 插件 Kirki – Freeform Page Builder, Website Builder & Customizer 存在盲服务端请求伪造（Blind Server-Side Request Forgery, SSRF）漏洞，影响 6.2.0 及以下所有版本，漏洞由 参数引发。该漏洞允许未经身份验证的攻击者发起源自 Web 应用程序、指向任意目标的 Web 请求，从而可用于探测和修改内部服务中的数据或状态信息。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-18335
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| themeum | Kirki – Freeform Page Builder, Website Builder & Customizer | 0 ~ 6.2.0 | - |
|
II. Public POCs for CVE-2026-18335
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-18335
请登录查看更多情报信息。
News Coverage for CVE-2026-18335 (1)
IV. Related Vulnerabilities
-
CVE-2026-17037
Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting -
CVE-2026-18347
Kirki <= 6.1.1 - Missing Authorization to Authenticated (Sub -
CVE-2026-17604
Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to A -
CVE-2026-16974
Kirki - Freeform Page Builder, Website Builder & Customizer -
CVE-2026-15601
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to
Same vendor: themeum
-
CVE-2026-18439
Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct -
CVE-2026-89081
Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'bac -
CVE-2026-88944
Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated -
CVE-2026-89333
Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Aut -
CVE-2026-92465
WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulne
Same weakness: CWE-918
-
CVE-2026-82375
Apache Roller: Server-side request forgery via entry trackba -
CVE-2026-100750
Joomla Extension - regularlabs.com - Arbitrary file read / S -
CVE-2026-101005
October CMS SSRF Protection ResizeImages.php validateExterna -
CVE-2026-100909
OctoberCMS ResizeImages.php getSourcePathForResize server-si -
CVE-2026-100901
athlon1600 youtube-downloader stream.php stream server-side
V. Comments for CVE-2026-18335
No comments yet