The Kirki WordPress plugin versions prior to 6.0.12 contain a Server-Side Request Forgery (SSRF) vulnerability (CWE-918). This occurs because the plugin does not validate URLs provided by users before performing HTTP requests on the server side. As a result, unauthenticated attackers can exploit this flaw to make the affected site issue HTTP requests to arbitrary external or internal hosts, potentially leading to information disclosure or interaction with internal network services.

An attacker can cause the vulnerable Kirki plugin to send HTTP requests to arbitrary hosts, which may allow interaction with internal systems not normally accessible externally. This can lead to information disclosure or further attacks depending on the internal network configuration. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to Kirki version 6.0.12 or later once available, as this version is indicated as the fixed release. Until then, consider restricting access to the plugin or disabling it if possible to prevent exploitation.