CVE-2026-12095 is a Server-Side Request Forgery (SSRF) vulnerability in the Kargo Takip WordPress plugin by bytuncay, affecting all versions up to and including 1.2. The vulnerability arises from improper validation of the 'api_url' parameter, allowing unauthenticated attackers to induce the server to send arbitrary HTTP requests. The plugin then returns the response data verbatim, including sensitive information such as any 'auth' key in JSON responses. This can lead to unauthorized querying and modification of internal services, including cloud instance metadata endpoints. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting a high-severity vulnerability with network attack vector, low attack complexity, no privileges or user interaction required, and partial confidentiality and integrity impact.

An unauthenticated attacker can exploit this SSRF vulnerability to make arbitrary HTTP requests from the vulnerable server to internal or external systems. This includes accessing sensitive internal services such as cloud metadata endpoints. The plugin's behavior of echoing internal API response data, including sensitive 'auth' keys, directly to the attacker enables data exfiltration. This can lead to unauthorized disclosure of sensitive information and potential modification of internal service data. There is no indication of availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Kargo Takip plugin or restricting access to the vulnerable functionality. Monitor vendor channels for updates and apply patches promptly when available.