CVE-2026-57627

Name of the Vulnerable Software and Affected Versions Kirki versions prior to 6.0.12

Description The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress contains a Server-Side Request Forgery (SSRF) flaw. This allows authenticated users with Subscriber-level access or higher to force the web application to make requests to arbitrary locations. This can be leveraged to query or modify information within internal services.

Recommendations Update the plugin to a version newer than 6.0.11.