Kirki WordPress Plugin CVE-2026-12721

The Kirki WordPress plugin must be installed and active on the target WordPress site running any version prior to 6.0.13. No authentication is required - the vulnerable parameter is accessible to unauthenticated HTTP requests (CVSS PR:N, UI:N). No special WordPress configuration or theme setup is required beyond the plugin being active. The specific vulnerable parameter and endpoint are identified in the WPScan advisory but not disclosed in this dataset. What limits exploitation: the attacker must know or discover the specific vulnerable request parameter; the injection appears to be read-only (C:H, I:N, A:N), so direct data modification or remote code execution via this vector alone is not indicated; and the low EPSS score suggests automated mass exploitation has not been widely observed despite POC availability.

The CVSS 8.6 score with AV:N/AC:L/PR:N/UI:N reflects a worst-case attacker posture: no authentication, no special conditions, exploitable over the network. The S:C designation implies the database is treated as a separate security domain from the web application, justifying the elevated score. However, the EPSS score of 0.18% at the 7th percentile is notably low given that a public POC exists - this discrepancy suggests the exploit may require precise knowledge of vulnerable parameter names, a specific plugin configuration, or that mass scanning has not yet adopted this CVE. The vulnerability is absent from the CISA KEV catalog, confirming no confirmed widespread active exploitation at time of analysis. Real-world risk is genuine but context-dependent: sites running the plugin with sensitive data in the WordPress database (credentials hashes, PII, e-commerce records) face meaningful exposure, while the limited integrity and availability impact (I:N/A:N) reduces the blast radius compared to a full read-write injection. The combination of a public POC and unauthenticated network vector means this should be treated as a priority patch on any production WordPress deployment running Kirki.

An unauthenticated attacker sends a crafted HTTP GET or POST request to the vulnerable WordPress endpoint handled by the Kirki plugin, embedding SQL metacharacters or UNION-based payloads in the targeted parameter. The unescaped value is concatenated directly into a SQL query executed against the WordPress MySQL database, allowing the attacker to enumerate table contents including wp_users (password hashes, email addresses) and any custom post meta or option data. A public proof-of-concept is available via WPScan, lowering the technical barrier for exploitation.