What is the CVSS score of CVE-2026-12721?

CVE-2026-12721 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Kirki WordPress Plugin are affected by CVE-2026-12721?

The Kirki WordPress plugin contains an unauthenticated SQL injection vulnerability (CVE-2026-12721, CVSS 8.6) affecting versions before 6.0.13, enabling attackers to directly read sensitive data from…. A patch is available.

Is there a public PoC exploit available for CVE-2026-12721?

Yes, a public proof-of-concept exploit is available for CVE-2026-12721. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-12721?

Within 24 hours, inventory all WordPress installations using the Kirki plugin and verify current versions deployed across your environment. Within 7 days, upgrade all affected instances to Kirki version 6.0.13 or later, prioritizing production systems and those handling sensitive customer data. Within 30 days, audit database access logs covering the vulnerability window for suspicious SQL queries or data extraction patterns, review user accounts for unauthorized credential usage, and conduct a forensic assessment of which data may have been accessible during the exposure period.

Kirki WordPress Plugin CVE-2026-12721

EUVD-2026-51432 HIGH

SQL Injection (CWE-89)

2026-07-31 WPScan

GHSA-8m37-w7r8-hcp2

WordPress SQLi Kirki Unknown

8.6

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network vector confirmed; S:U preferred over vendor S:C as injection reads within the WordPress database boundary, not a separate system; I:N and A:N reflect read-only impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 17:23 vuln.today

CVSS changed

Jul 31, 2026 - 17:22 NVD

8.6 (HIGH)

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

HIGH 8.6

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 2 Critical, 13 With POC Aug 01, 2026

AnalysisAI

SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbitrary data from the underlying WordPress database by injecting malicious SQL through an unsanitized request parameter. The CVSS vector scores this 8.6 with a scope change reflecting potential access to the database tier beyond the web application boundary, with high confidentiality impact but no integrity or availability impact - consistent with a read-only injection primitive. A public proof-of-concept exploit exists per WPScan, though the EPSS score of 0.18% (7th percentile) indicates low observed exploitation probability relative to the theoretical severity, and the vulnerability has not been added to the CISA KEV catalog.

Technical ContextAI

Kirki is a WordPress plugin that extends the WordPress Theme Customizer API, providing a framework for theme developers to build rich customization interfaces. The affected code path accepts a value directly from the HTTP request and interpolates it into a SQL statement without sanitization or parameterization, a textbook CWE-89 (Improper Neutralization of Special Elements used in a SQL Command) defect. WordPress plugins interact with the WordPress-managed MySQL database via the wpdb class, which provides prepared statement helpers; the failure to use these helpers or equivalent escaping functions is the root cause. The CPE string cpe:2.3:a:unknown:kirki:*:*:*:*:*:*:*:* covers all versions of Kirki up to (exclusive) 6.0.13, as confirmed by EUVD entry EUVD-2026-51432.

RemediationAI

Update the Kirki WordPress plugin to version 6.0.13 or later, which contains the vendor-released fix for this SQL injection. The WPScan advisory at https://wpscan.com/vulnerability/4cba3900-9f29-4928-811c-163827358052/ provides further detail. If immediate patching is not feasible, a compensating control is to deactivate the Kirki plugin entirely until the update can be applied - this eliminates the attack surface at the cost of disabling theme customization functionality. An alternative short-term measure is to deploy a web application firewall (WAF) rule blocking SQL metacharacter patterns in requests to WordPress endpoints, though WAF rules can be bypassed by encoding or obfuscation and should not substitute for patching. No other mitigations specific to this parameter are identifiable from the available data.