CVE-2026-57627

Server Side Request Forgery (SSRF) vulnerability in Kirki plugin versions up to 6.0.11 allows a subscriber to send HTTP requests from the server to internal network resources.

An attacker with subscriber privileges can exploit this vulnerability to scan internal networks, access sensitive data, or perform attacks on other services within the infrastructure.

Immediately update the Kirki plugin to version 6.0.12 or later, which includes a fix for the SSRF vulnerability.