CVE-2026-57627 Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions

Description

Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions.

Affected products and versions

Product	Affected versions	Fixed in
Kirki 6.0	earliest → 6.0.11	No fix stated

Other CVEs of Kirki

The 12 CVEs of Kirki →

CVE-2026-112348 Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token 6.9 Medium CVE-2026-112347 Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST… 7.2 High CVE-2026-42694 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki… 4.3 Medium CVE-2026-103065 Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality… 8.2 High