CVE-2026-12095

Name of the Vulnerable Software and Affected Versions Kargo Takip versions prior to 1.3

Description The Kargo Takip plugin for WordPress contains a Server-Side Request Forgery (SSRF) issue. This allows unauthenticated attackers to initiate web requests to arbitrary locations from the web application, which can be used to query and modify information from internal services. The issue occurs via the api url parameter. The script returns internal API response data, specifically the value of any auth key in a JSON response body, directly to the attacker's browser. This enables the exfiltration of responses from internal services, such as cloud instance metadata endpoints.

Recommendations Update to a version later than 1.2. As a temporary workaround, restrict access to the api url parameter to minimize the risk of exploitation.