CVE-2026-12721 in Kirki Plugin
Summary
by MITRE • 07/31/2026
The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/31/2026
The vulnerability resides within the Kirki WordPress plugin version 6.0.12 and earlier, where insufficient input validation and sanitization creates a critical security flaw that enables unauthenticated SQL injection attacks. This issue stems from the plugin's failure to properly sanitize and escape user-supplied data before incorporating it into database queries, creating an avenue for malicious actors to manipulate backend database operations without requiring authentication credentials.
The technical exploitation occurs when attacker-controlled parameters are passed through HTTP requests directly into SQL execution contexts within the plugin's codebase. According to CWE-89, this represents a classic SQL injection vulnerability where user input flows into SQL commands without adequate protection mechanisms. The vulnerability allows attackers to craft malicious payloads that can execute arbitrary SQL commands on the underlying database server, potentially leading to complete database compromise and unauthorized data access.
This flaw impacts the broader WordPress ecosystem by providing attackers with a pathway to exploit vulnerable sites running affected plugin versions. The unauthenticated nature of this attack means that any user with access to the web application can leverage this vulnerability without needing valid credentials or privileged accounts. From an operational perspective, successful exploitation could result in data exfiltration, database corruption, unauthorized account creation, and potential lateral movement within compromised environments.
The security implications extend beyond immediate data compromise as attackers can use this vulnerability to establish persistent access patterns and potentially escalate privileges within the application environment. Attackers may leverage this weakness to extract sensitive information including user credentials, personal data, and administrative access details stored in the database. The ATT&CK framework categorizes this as a SQL Injection technique under the T1071.004 sub-technique for Application Layer Protocol: Database Protocol, with potential progression to privilege escalation and lateral movement activities.
Mitigation strategies should include immediate upgrade to Kirki plugin version 6.0.13 or later, which addresses the sanitization issues through proper input validation and escaping mechanisms. Organizations should implement web application firewalls with SQL injection detection capabilities and regularly audit their WordPress installations for vulnerable plugins. Additionally, database query parameterization techniques should be enforced throughout all application code to prevent similar issues in other components, while regular security monitoring and vulnerability scanning should be maintained to identify potential exploitation attempts.