CVE-2026-84224

4.1 Moyenne

Publiée le 09/10/2026 à 11:17 · Modifiée le 09/10/2026 à 17:17 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.

Traduire en français

Produits concernés

Unknown Kirki

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.1 Moyenne	contact@wpscan.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-918

Références

https://wpscan.com/vulnerability/6a2455dd-8da9-4c7e-a249-3c694cf2983e/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories