CVE-2026-18335

Description

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Overview

State: PUBLISHED
Assigner (CNA): Wordfence
CVSS severity: MEDIUM
CVSS score: 5.4 / 10
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Effective score: 5.4 / 10 MEDIUM source: CNA overview
CWE(s): CWE-918
Reserved: 2026-07-29
Published: 2026-09-24 09:27 UTC
Last updated: 2026-09-24 15:04 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18335.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

EPSS score: 0.0026 (probability of exploitation in next 30 days)
EPSS percentile: 15.35% vs all CVEs — higher = more likely to be exploited, as of 2026-09-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-85838
Assigner: Wordfence
Published: Sep 24, 2026, 9:27:45 AM
Updated: Sep 24, 2026, 3:04:06 PM
EUVD base score (CVSS 3.1): 5.4 / 10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
EUVD-reported EPSS: 0.2600
Vendors: Themeum
Products: Kirki – Freeform Page Builder, Website Builder & Customizer (0 ≤6.2.0)
Aliases: GHSA-8q4x-8xp2-6ww3

ENISA description: The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

EUVD references (2)

Affected products (1)

Vendor	Product	Versions	Platforms
themeum	Kirki – Freeform Page Builder, Website Builder & Customizer	`0` (affected)	—

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Remediations (10)

CVE-2026-33835 - Vulnerability Details - OpenCVE

web:app.opencve.io

Remediation No vendor fix or workaround currently provided. OpenCVE Recommended Actions Apply the latest Microsoft security update that addresses CVE - 2026 -33835. Restrict user permissions so that only trusted accounts can access or modify Cloud Files data.

2026-09-25 10:47 UTC
CVE-2026-18335 - Exploits & Severity - Feedly

web:feedly.com

This CVE ID has been reserved by a CNA but the vulnerability details have not yet been published. Feedly AI found some discussions about it.

2026-09-25 10:47 UTC
Security Advisories and Bulletins | Microsoft Learn

web:learn.microsoft.com

Learning path Learn how Microsoft supports secure software development as part of a cybersecurity solution - Training Secure software development means integrating security into each phase of your development lifecycle, from requirements analysis to maintenance. Microsoft provides many services that can help you develop more secure code and deploy a more secure application in the cloud. This ...

2026-09-25 10:47 UTC
Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-09-25 10:47 UTC
CVE-2026-33835: Windows Cloud Files EoP in Mini Filter Driver

web:windowsforum.com

Microsoft disclosed CVE - 2026 -33835 on May 12, 2026 , as a Windows Cloud Files Mini Filter Driver elevation-of-privilege vulnerability, addressed through the May Patch Tuesday security updates for affected Windows systems and documented in the Microsoft Security Response Center's Security Update Guide.

2026-09-25 10:47 UTC
What Is CVE Remediation in 2026? - aikido.dev

web:www.aikido.dev

CVE remediation is fixing known flaws in the software you run. Why upgrading often fails, what remediation actually involves, and how backporting fixes it.

2026-09-25 10:47 UTC
Patch vs. Workaround: How CVEs Actually Get Fixed

web:www.bitsight.com

By covering multiple products and analyzing these CVEs , we aim to provide valuable insights and statistics on how companies defend against vulnerabilities. This analysis will help us understand the effectiveness of different mitigation strategies and identify any trends in vulnerability management. Dissecting CVE -2022-41040: Insights into the Microsoft Exchange Server exploit CVE -2022-41040 is ...

2026-09-25 10:47 UTC
DSA-2026-353: Security Update for Cloud Disaster Recovery ...

web:www.dell.com

Cloud Disaster Recovery remediation is available for multiple security vulnerabilities that could be exploited by malicious users to compromise the affected system.

2026-09-25 10:47 UTC
CVE-2026-18335 | Tenable®

web:www.tenable.com

The Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information ...

2026-09-25 10:47 UTC
Patch Tuesday September 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's September 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-09-25 10:47 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-18335.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18335",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T13:58:50.774268Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T15:04:06.565Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kirki \u2013 Freeform Page Builder, Website Builder & Customizer",
          "vendor": "themeum",
          "versions": [
            {
              "lessThanOrEqual": "6.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Khoa Dang"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Kirki \u2013 Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T09:27:45.134Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/461be8a5-bf72-4028-88e6-bf6544120ac6?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3636487/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-22T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2026-07-29T21:19:24.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-23T21:24:39.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Kirki \u2013 Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-18335",
    "datePublished": "2026-09-24T09:27:45.134Z",
    "dateReserved": "2026-07-29T20:52:50.109Z",
    "dateUpdated": "2026-09-24T15:04:06.565Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}