Kirki Plugin Server-Side Request Forgery via URL Validation Bypass

The Kirki WordPress plugin before version 6.0.12 contains a critical Server-Side Request Forgery (SSRF) vulnerability that allows unauthenticated attackers to exploit inadequate URL validation. When the plugin processes user-supplied URLs without proper sanitization, an attacker can craft malicious requests that force the vulnerable WordPress server to make HTTP calls to arbitrary internal or external hosts. This vulnerability affects any WordPress installation using the affected Kirki plugin versions, potentially exposing internal services, metadata endpoints, cloud credentials, and sensitive data accessible only from the server's network context. With a CVSS score of 9.1, this represents a critical risk that can lead to information disclosure, lateral movement, and further compromise of the hosting infrastructure.

While this specific CVE currently has no mapped MITRE ATT&CK techniques, Casky's Claude-powered analysis would identify the underlying attack patterns associated with SSRF exploitation, including reconnaissance of internal services (T1592 - Gather Victim Network Information), exploitation of trust relationships (T1199 - Trusted Relationship), and potential access to cloud metadata services (T1526 - Cloud Service Discovery). Security practitioners monitoring their environments through Casky would observe suspicious outbound HTTP requests from their WordPress server to unexpected internal IP ranges or cloud metadata endpoints, unusual request patterns from the web server process, and potential access logs showing requests to localhost services or RFC 1918 addresses. Detection would focus on analyzing HTTP request logs for unvalidated URL parameters being processed server-side and monitoring for anomalous external connectivity initiated by the WordPress application.