Server-Side Request Forgery Vulnerability in Kargo Takip Plugin for WordPress

CVE-2026-12095

What is CVE-2026-12095?

The Kargo Takip plugin for WordPress is vulnerable to a Server-Side Request Forgery (SSRF) attack due to improper validation of the 'api_url' parameter. This vulnerability exists in all versions up to and including 1.2, allowing unauthenticated attackers to initiate web requests to arbitrary locations from the web application. The exploitation of this flaw can enable attackers to query and manipulate information from internal services, as the script reveals internal API responses, specifically data associated with the 'auth' key in JSON responses. This exposure can lead to significant security risks, including the exfiltration of sensitive information from internal services, such as cloud instance metadata endpoints.

References