A critical SSRF vulnerability in the Kirki WordPress plugin allows unauthenticated attackers to force the server to interact with arbitrary internal or external systems.

The plugin contains a Server-Side Request Forgery (SSRF) flaw where it fails to validate user-supplied URLs before making server-side requests. This allows an unauthenticated attacker to manipulate the server into reaching out to unauthorized internal network resources or external hosts.

With a CVSS score of 9.1, this critical vulnerability provides a direct pathway for attackers to bypass perimeter firewalls and interact with sensitive internal services that are not exposed to the public internet. Successful exploitation could lead to unauthorized information disclosure, the execution of actions on internal platforms, or the mapping of the internal network architecture, severely impacting organizational security posture.

Immediate Action: Update the Kirki plugin to version 6.0.12 or higher to resolve the input validation failure.

Proactive Monitoring: Monitor server egress traffic for unusual requests originating from the web server to internal IP addresses or sensitive network segments.

Compensating Controls: Use a Web Application Firewall (WAF) to filter and block suspicious URL parameters, and ensure the server is restricted from making unnecessary outbound connections to internal resources.

Public Exploit Available: Yes (Public proof-of-concept exploits are available.)

The availability of public proof-of-concept exploits significantly elevates the risk of exploitation. System administrators are strongly advised to prioritize the update to version 6.0.12 to close this critical security gap and prevent potential lateral movement within the network.