CVE-2026-18335

Executive Summary

CVE-2026-18335 is a Blind Server-Side Request Forgery (SSRF) vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress, affecting all versions up to and including 6.2.0. The flaw is reachable through the kirki_data parameter and is exploitable by unauthenticated attackers, allowing requests to arbitrary locations to originate from the vulnerable web application. Because the requests are blind, direct response data is not returned to the attacker, but the primitive can still be used to query and modify information from internal services, potentially exposing internal-only endpoints and enabling further lateral movement.

Technical Analysis

The vulnerability class is CWE-918 (Server-Side Request Forgery). Per the supplied NVD description, the affected component is the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin, versions up to and including 6.2.0, and the vulnerable entry point is the kirki_data parameter. The description explicitly characterizes the issue as blind SSRF, meaning the attacker induces the server-side application to perform outbound requests to an attacker-chosen destination, but the application does not reflect the target's response body back to the requester.

Attack-surface characteristics derived from the provided data:

• Unauthenticated reachability. The CVSS vector carries PR:N and UI:N, so no prior authentication or user interaction is required. This means the vulnerable code path handling kirki_data is reachable without valid WordPress credentials, which is significant for a plugin (builder/customizer plugins often expose front-end or AJAX-facing functionality).
• Scope change (S:C). The scope is marked Changed, indicating the security impact can cross a security authority boundary — consistent with an SSRF where the vulnerable application (web host) can be leveraged against other components (internal services) outside the application's own security scope.
• Impact profile. Confidentiality and Integrity are both Low (C:L/I:L); Availability is None (A:N). The description states the primitive "can be used to query and modify information from internal services," aligning with low C/I impact rather than full compromise.
• Blind nature. Because replies are not returned, exploitation typically requires inference techniques (timing, out-of-band callbacks, error/behavioral oracles) to confirm reachability and target state. This explains the High attack-complexity rating (AC:H) in the vector.

What the provided data does not include: specific function names, class names, REST endpoints, AJAX hook names, request methods (GET/POST), or the exact internal parsing logic behind kirki_data. There is insufficient technical detail to describe code-level control flow, so any such specifics would be speculative and are deliberately not asserted here. The kirki_data parameter name is quoted verbatim from the NVD description and is the only parameter identifier that may be relied upon.

Because SSRF lets the server issue requests on the attacker's behalf, the primary value to an adversary is reaching network resources not directly exposed to the internet — for example, HTTP-reachable internal services accessible from the WordPress host. The plugin's role as a website/page builder and customizer implies normal deployment on internet-facing WordPress sites, which broadens the population of potentially exposed instances.

Exploitation Scenarios

The attack chain is inferred strictly from the vulnerability class (blind SSRF) and the metadata provided. No public PoC, exploit code, or Nuclei template is available; the chain below is class-level and does not rely on fabricated implementation details.

1. Reconnaissance / target identification. An unauthenticated attacker enumerates internet-facing WordPress sites running the Kirki plugin. Fingerprinting is possible via public application assets associated with the plugin (e.g., plugin paths served under the WordPress content directory) and via the presence of the kirki_data parameter in application requests/responses. Shodan or similar internet-scanning services can be used to find candidate hosts serving the plugin's assets.

2. Triggering the flaw class. The attacker submits a request that reaches the plugin's handling of the kirki_data parameter. Since the description states the parameter is the vector and the vulnerability is unauthenticated, no login is required. The crafted input causes the server to initiate an outbound network request to a destination chosen (directly or by influence) by the attacker. At this level of detail, the precise payload syntax is not disclosed, so the attack is characterized as "supply the attacker-controlled destination through kirki_data."

3. Payload / execution method (vulnerability-class level). Because the SSRF is blind, the attacker generally cannot read the target's response directly. Confirmation of the primitive and of internal reachability relies on blind techniques such as:

   • Out-of-band interaction — directing the server to contact an attacker-controlled listener to confirm that the request was issued.
   • Behavioral/timing oracles — observing response time differences, error behavior, or state changes conditioned on whether a given internal target responded. No specific encoding, URL scheme, or redirection technique is asserted because the supplied data does not describe them.

4. Post-exploitation impact. With a working blind SSRF primitive, an attacker can attempt to query and modify information from internal services reachable by the WordPress host — consistent with the description and the C:L/I:L ratings. Potential downstream consequences include interacting with internal HTTP services, cloud metadata-style endpoints where reachable, or administrative interfaces bound to internal addresses. Because the responses are blind, modification or state-changing effects may require inference to verify. Availability is not impacted (A:N), and there is no evidence in the provided data of remote code execution or full host compromise.

Impact Assessment

• Base score: CVSS 3.1 = 5.4 (Medium), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N.
• Attack vector (AV:N): Network-exploitable — reachable remotely.
• Attack complexity (AC:H): High. The blind nature of the SSRF and the need for inference/out-of-band techniques raise the skill and setup requirements.
• Privileges required (PR:N): None. The description explicitly states unauthenticated attackers.
• User interaction (UI:N): None required.
• Scope (S:C): Changed — impact can extend beyond the vulnerable component to other services, which is the essence of SSRF risk against internal infrastructure.
• Confidentiality (C:L) / Integrity (I:L): Low impact each — the attacker can query and modify certain information from internal services but does not obtain broad data access or arbitrary write.
• Availability (A:N): No availability impact.

Business impact. Any internet-facing WordPress deployment running the Kirki plugin at version ≤ 6.2.0 is potentially affected. The practical risk profile is that of an internal-network reconnaissance and reachability pivot: an external, unauthenticated actor can use the web server as a proxy to probe or interact with services that are otherwise segmented from the internet. This weakens network segmentation assumptions and may expose internal APIs or administrative interfaces. The blast radius is therefore defined by (a) the number of exposed instances and (b) the sensitivity of internal services reachable from those instances' network position.

Prioritization. With a Medium CVSS base and High complexity, this is not a high-velocity mass-exploitation candidate, and no exploit code or PoC is currently available. It should still be remediated because it is unauthenticated and scope-changing, and because SSRF primitives are frequently chained with other weaknesses. The plugin may be installed on a large number of sites, so exposures are likely to be numerous even if exploitation is not trivial.

Detection Guidance

Detection should focus on two planes: (1) application/host telemetry showing requests to the plugin's kirki_data handling, and (2) network telemetry showing the server issuing unexpected outbound requests to internal or unusual destinations. No public exploit exists, so rules below are behavior-based and will require environment-specific tuning; false positives are expected and should be tuned before alerting.

Sigma Rule

title: Potential Blind SSRF Attempt via Kirki Plugin kirki_data Parameter
id: 7f5b2c9e-1a44-4d3e-9b21-0c8a6e2f9d10
status: experimental
description: Detects HTTP requests carrying the kirki_data parameter to WordPress instances running the vulnerable Kirki plugin, indicative of blind SSRF probing (CVE-2026-18335).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-18335
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_param:
    - cs_uri_query|contains: 'kirki_data'
    - cs-uri-query|contains: 'kirki_data'
    - url|contains: 'kirki_data'
  selection_path:
    - cs_uri_stem|contains: '/wp-content/plugins/kirki'
    - url|contains: '/wp-content/plugins/kirki'
    - url|contains: '/wp-admin/admin-ajax.php'
  condition: selection_param and selection_path
fields:
  - c-ip
  - cs-uri-query
  - cs-uri-stem
  - cs(User-Agent)
falsepositives:
  - Legitimate plugin configuration and customization traffic using kirki_data
level: medium
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.18335

YARA Rule

rule CVE_2026_18335_Kirki_Blind_SSRF
{
    meta:
        description = "Detects references to the vulnerable kirki_data parameter and Kirki plugin artifacts that may indicate exploit attempts against CVE-2026-18335 (blind SSRF)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-18335"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $param = "kirki_data" ascii wide nocase
        $plugin = "/wp-content/plugins/kirki" ascii wide nocase
        $ssrf1 = "127.0.0.1" ascii wide
        $ssrf2 = "169.254.169.254" ascii wide
        $ssrf3 = "localhost" ascii wide nocase

    condition:
        $param and ( $plugin or 1 of ($ssrf*) )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-18335 Kirki WordPress Plugin Blind SSRF Attempt via kirki_data"; flow:to_server,established; http.uri; content:"kirki_data"; nocase; http.uri; content:"/wp-content/plugins/kirki"; nocase; classtype:web-application-attack; reference:cve,2026-18335; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-18335; sid:202618335; rev:1;)

alert http any any -> any any (msg:"CVE-2026-18335 Kirki kirki_data SSRF - internal target reference"; flow:to_server,established; http.uri; content:"kirki_data"; nocase; http.uri; pcre:"/(127\.0\.0\.1|localhost|169\.254\.169\.254|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+)/i"; classtype:web-application-attack; reference:cve,2026-18335; sid:202618336; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and
      url.query : "*kirki_data*" and
      (url.path : "*/wp-content/plugins/kirki*" or url.path : "*/wp-admin/admin-ajax.php") ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=nginx OR sourcetype=iis
| eval uri=coalesce(uri, url, cs_uri_stem, request)
| eval qs=coalesce(uri_query, cs_uri_query, query_string)
| where (like(uri, "%/wp-content/plugins/kirki%") OR like(uri, "%/wp-admin/admin-ajax.php%") OR like(qs, "%kirki_data%"))
| search qs="*kirki_data*"
| eval ssrf_target=if(match(qs, "(?i)(127\.0\.0\.1|localhost|169\.254\.169\.254|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[01])\.\d+\.\d+)"), "internal_target", "generic")
| stats count min(_time) as first_seen max(_time) as last_seen values(ssrf_target) as target_type by src_ip, uri
| where count > 0
| sort - count
| `comment("CVE-2026-18335 - Kirki blind SSRF via kirki_data; tune for legitimate plugin traffic")`

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-18335,">
  <rule id="2026183" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>kirki_data</url>
    <description>CVE-2026-18335: Possible Kirki WordPress plugin blind SSRF attempt via kirki_data parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_scan,pci_dss_6.5.1,</group>
  </rule>

  <rule id="2026184" level="12">
    <if_sid>2026183</if_sid>
    <url>127.0.0.1</url>
    <description>CVE-2026-18335: Kirki kirki_data SSRF probe targeting loopback address</description>
    <options>no_full_log</options>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="2026185" level="12">
    <if_sid>2026183</if_sid>
    <url>169.254.169.254</url>
    <description>CVE-2026-18335: Kirki kirki_data SSRF probe targeting cloud metadata endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (NVD) claims a patch, but no vendor fix reference, fixed version, or advisory has been independently confirmed. Treat the following as layered mitigation until a verified fix is available.

1) Immediate mitigations

• Restrict outbound (egress) traffic from the WordPress host. Apply deny-by-default egress filtering so the web server can only reach the destinations it legitimately requires. Block or explicitly deny requests to loopback (127.0.0.0/8), private ranges (RFC 1918), link-local (169.254.0.0/16), and cloud metadata addresses unless required.
• Virtual patching. If a WAF is in place, block or challenge requests containing the kirki_data parameter from untrusted sources, particularly where the value references internal or unusual destinations. Restrict access to the plugin's kirki_data handling to trusted/authenticated contexts where operationally feasible.
• Network segmentation. Ensure the WordPress host is on a segmented network with no unnecessary reachability to internal management interfaces, internal-only APIs, or database services.
• Disable the plugin if unused. If the Kirki plugin is not required, deactivate and remove it to eliminate the attack surface entirely.

2) Patch / upgrade steps

• Monitor the vendor's distribution channel (the WordPress plugin repository and the vendor site) for a release that fixes CVE-2026-18335. At the time of writing, no fixed version is enumerated and the affected upper bound is 6.2.0.
• When a patched version becomes available, validate it in a staging environment, back up the site (files and database), then update the plugin to the fixed release.
• Because the patch is only CLAIMED by a single source, independently verify the fix by consulting the vendor advisory and confirming the vulnerability class is addressed before relying on it.

3) Long-term hardening

• Maintain a WordPress software inventory and subscribe to timely vulnerability feeds for all installed plugins/themes.
• Enforce least-privilege outbound egress for web-tier hosts as standing policy, not only during incidents.
• Deploy behavior-based detection (the rules above) for SSRF patterns and monitor egress logs for unexpected internal-destination requests.
• Keep WordPress core, plugins, and themes current, and remove unused components to reduce exposed attack surface.

References

• NVD — CVE-2026-18335: https://nvd.nist.gov/vuln/detail/CVE-2026-18335
• CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• WordPress Plugin Security / Hardening guidance: https://developer.wordpress.org/plugins/security/
• OWASP — Server-Side Request Forgery Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat actor / exploit-in-the-wild status: No public proof-of-concept, exploit code, or Nuclei template is available. CVE-2026-18335 is not listed in CISA KEV. No confirmed threat actor campaigns or in-the-wild exploitation evidence were identified in the provided data. EPSS has not yet been scored by FIRST.org.