What is CVE-2026-18335?

CVE-2026-18335 is a medium-severity vulnerability in Themeum Kirki – Freeform Page Builder, Website Builder & Customizer, classified under Server-Side Request Forgery (SSRF). CVSS score: 5.4/10. Published 2026-09-24.

How severe is CVE-2026-18335?

Medium severity. CVSS v3 base score is 5.4 out of 10.

SSRF in Themeum Kirki – Freeform Page Builder, Website Builder & Customizer

CVE-2026-18335

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Vulnerability class: SSRF (Server-Side Request Forgery)

Published 2026-09-24 · last modified 2026-09-24.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N.

EPSS exploit prediction

EPSS: 0.003 (15.3th percentile), scored 2026-09-25.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 15th percentile — 15.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Affected products

Themeum Kirki – Freeform Page Builder, Website Builder & Customizer

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

Frequently asked questions

What is CVE-2026-18335?: CVE-2026-18335 is a medium-severity vulnerability in Themeum Kirki – Freeform Page Builder, Website Builder & Customizer, classified under Server-Side Request Forgery (SSRF). CVSS score: 5.4/10. Published 2026-09-24.
How severe is CVE-2026-18335?: Medium severity. CVSS v3 base score is 5.4 out of 10.