PULSE
LIVE28signals / 24h
ES
FEED
ransomtitan reclama a PERTINENT HEALTHCARE BUSINESS SOLUTIONS PRIVATE LIMITED · IN · Healthcareransomworldleaks reclama a St. Francis Xavier Catholic School System · US · Educationransomworldleaks reclama a PinnPACK · US · Manufacturingransomspacebears reclama a DoAllTech · KR · Technologyransomspacebears reclama a Anpra SAS · CO · Business Servicesransomspacebears reclama a BiesSse Group · IT · Business Servicesransomqilin reclama a Postres Reina · ES · Agriculture and Food Productionransomsafepay reclama a wdk.de · DE · Not Foundransomsafepay reclama a jaecklin-industrial.de · DE · Manufacturingransomsafepay reclama a lbb-treuhand.de · DE · Business Servicesransomsafepay reclama a timetex.de · DE · Business Servicesransomsafepay reclama a stroebel-gruppe.de · DE · Manufacturingransomsafepay reclama a industriesjaro.com · CA · Manufacturingransomsafepay reclama a cenesco.de · DE · Not Foundransomtitan reclama a PERTINENT HEALTHCARE BUSINESS SOLUTIONS PRIVATE LIMITED · IN · Healthcareransomworldleaks reclama a St. Francis Xavier Catholic School System · US · Educationransomworldleaks reclama a PinnPACK · US · Manufacturingransomspacebears reclama a DoAllTech · KR · Technologyransomspacebears reclama a Anpra SAS · CO · Business Servicesransomspacebears reclama a BiesSse Group · IT · Business Servicesransomqilin reclama a Postres Reina · ES · Agriculture and Food Productionransomsafepay reclama a wdk.de · DE · Not Foundransomsafepay reclama a jaecklin-industrial.de · DE · Manufacturingransomsafepay reclama a lbb-treuhand.de · DE · Business Servicesransomsafepay reclama a timetex.de · DE · Business Servicesransomsafepay reclama a stroebel-gruppe.de · DE · Manufacturingransomsafepay reclama a industriesjaro.com · CA · Manufacturingransomsafepay reclama a cenesco.de · DE · Not Found
← All CVEs
CVE WatchJul 20, 2026

CVE-2026-13147

The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated a

CVSS

9.1

Critical

EPSS

0.1%

p3

KEV

—

Exploit Today

1

0-100

Published: Jul 20, 2026 · Last modified: Jul 20, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).

Official references
Related CVEs

No related CVEs by CWE or product.