CVE-2026-12095

HighCVSS 7.2/10Last modified Jun 25, 2026

Description

The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2 via the 'api_url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The script echoes internal API response data (specifically the value of any 'auth' key in a JSON response body) verbatim back to the attacker's browser, enabling direct exfiltration of responses from internal services such as cloud instance metadata endpoints.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
bytuncay	Kargo Takip	<= 1.2

References

Timeline

Published: Jun 24, 2026
Last modified: Jun 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1209527.1An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a CVE-2026-1209534.3A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the drive CVE-2026-1209543.7A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number CVE-2026-1209557.5The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions durin CVE-2026-1209567.1The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoin CVE-2026-1209593.7A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can cause values returned for a query to be written outside the bounds of a buff CVE-2026-120975.3The User Management plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2. This is due to the CVE-2026-1209715.3A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by CVE-2026-1209745.3On affected platforms running Arista EOS with IPsec AutoVPN Feature configured with dynamic paths, the configured IPsec replay window may no CVE-2026-1209753.1On affected platforms running Arista EOS with automatic certificate management configured and automatic Certificate Authority (CA) certifica CVE-2026-1209766.0On affected platforms running Arista EOS with IEEE 802.1X authentication and MACsec using dynamically derived keys, sensitive authentication CVE-2026-1209778.2On affected platforms running Arista EOS with 802.1X with Dynamic Host Configuration Protocol (DHCP) device profiling enabled, a network-adj