CVE-2026-18335 is a Blind SSRF vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin affecting versions from 0 up to 6.2.0 inclusive. The vulnerability arises from improper validation of the 'kirki_data' parameter, allowing unauthenticated remote attackers to induce the server to send HTTP requests to arbitrary locations. This can be leveraged to interact with internal services behind firewalls or otherwise inaccessible from the outside. The CVSS 3.1 base score is 5.4 (medium severity) with vector AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N, indicating network attack vector, high attack complexity, no privileges or user interaction required, and partial confidentiality and integrity impact with no availability impact.

An unauthenticated attacker can exploit this SSRF vulnerability to make the server send arbitrary HTTP requests to internal or external systems. This can lead to unauthorized information disclosure and modification of internal service data. The vulnerability has a medium severity score, reflecting limited but meaningful confidentiality and integrity impacts without availability disruption. There are no known exploits in the wild at this time.

No official patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable plugin and consider disabling or removing it if possible. Monitor for updates from the vendor themeum regarding a security patch for this issue.