What is the CVSS score of CVE-2026-12721?

CVE-2026-12721 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Kirki WordPress Plugin are affected by CVE-2026-12721?

The Kirki WordPress plugin contains an unauthenticated SQL injection vulnerability (CVE-2026-12721, CVSS 8.6) affecting versions before 6.0.13, enabling attackers to directly read sensitive data from…. A patch is available.

Is there a public PoC exploit available for CVE-2026-12721?

Yes, a public proof-of-concept exploit is available for CVE-2026-12721. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-12721?

Within 24 hours, inventory all WordPress installations using the Kirki plugin and verify current versions deployed across your environment. Within 7 days, upgrade all affected instances to Kirki version 6.0.13 or later, prioritizing production systems and those handling sensitive customer data. Within 30 days, audit database access logs covering the vulnerability window for suspicious SQL queries or data extraction patterns, review user accounts for unauthorized credential usage, and conduct a forensic assessment of which data may have been accessible during the exposure period.

Kirki WordPress Plugin CVE-2026-12721

EUVD-2026-51432 HIGH

SQL Injection (CWE-89)

2026-07-31 WPScan

GHSA-8m37-w7r8-hcp2

WordPress SQLi Kirki

8.6

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network vector confirmed; S:U preferred over vendor S:C as injection reads within the WordPress database boundary, not a separate system; I:N and A:N reflect read-only impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 17:23 vuln.today

CVSS changed

Jul 31, 2026 - 17:22 NVD

8.6 (HIGH)

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

HIGH 8.6

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 2 Critical, 13 With POC Aug 01, 2026

AnalysisAI

SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbitrary data from the underlying WordPress database by injecting malicious SQL through an unsanitized request parameter. The CVSS vector scores this 8.6 with a scope change reflecting potential access to the database tier beyond the web application boundary, with high confidentiality impact but no integrity or availability impact - consistent with a read-only injection primitive. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WordPress site running Kirki plugin

Delivery

Send unauthenticated HTTP request with SQL payload

Exploit

Bypass absent input sanitization

Execution

Execute injected SQL against WordPress database

Impact

Exfiltrate user credentials and sensitive database contents

Access

Identify WordPress site running Kirki plugin

Delivery

Send unauthenticated HTTP request with SQL payload

Exploit

Bypass absent input sanitization

Execution

Execute injected SQL against WordPress database

Impact

Exfiltrate user credentials and sensitive database contents

Vulnerability AssessmentAI

Exploitation	The Kirki WordPress plugin must be installed and active on the target WordPress site running any version prior to 6.0.13. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 8.6 score with AV:N/AC:L/PR:N/UI:N reflects a worst-case attacker posture: no authentication, no special conditions, exploitable over the network. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker sends a crafted HTTP GET or POST request to the vulnerable WordPress endpoint handled by the Kirki plugin, embedding SQL metacharacters or UNION-based payloads in the targeted parameter. The unescaped value is concatenated directly into a SQL query executed against the WordPress MySQL database, allowing the attacker to enumerate table contents including wp_users (password hashes, email addresses) and any custom post meta or option data. …
Remediation	Update the Kirki WordPress plugin to version 6.0.13 or later, which contains the vendor-released fix for this SQL injection. … Detailed patch versions, workarounds, and compensating controls in full report.