WordPress Plugin Vulnerabilities

Kirki < 6.0.13 - Unauthenticated SQL Injection

Description

The plugin does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

Proof of Concept

Affects Plugins

Plugin icon
kirki
Fixed in 6.0.13

References

CVE
CVE-2026-12721

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
8.6 (high)

Miscellaneous

Original Researcher
Hermanhms
Submitter
Hermanhms
Submitter website
https://www.jakubherman.net
Verified
Yes
WPVDB ID
4cba3900-9f29-4928-811c-163827358052

Timeline

Publicly Published
2026-07-14 (about 14 days ago)
Added
2026-07-14 (about 13 days ago)
Last Updated
2026-07-27 (about 7 hours ago)

Other

Published
Title
Published
2014-08-01
Title
Z-Vote 1.1 - SQL Injection
Published
2024-07-04
Title
Paid Memberships Pro < 3.0.6 - Authenticated (Administrator+) SQL Injection
Published
2026-03-23
Title
Beaver Builder < 2.10.1.5 - Authenticated (Contributor+) SQL Injection
Published
2026-07-22
Title
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker < 11.2.1 - Authenticated (Contributor+) SQL Injection
Published
2025-06-16
Title
Blog2Social < 8.4.5 - Authenticated (Subscriber+) SQL Injection via `prgSortPostType` Parameter