What is the CVSS score of CVE-2026-57726?

CVE-2026-57726 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of Wordpress Plugin are affected by CVE-2026-57726?

Themeum Kirki WordPress customizer framework (versions ≤6.0.12) contains an unauthenticated SQL injection vulnerability enabling remote attackers to extract sensitive database contents.

How to fix or mitigate CVE-2026-57726?

Within 24 hours: audit all WordPress installations for Kirki versions ≤6.0.12 and immediately disable the plugin; examine database query logs for anomalous SQL patterns that may indicate prior exploitation. Within 7 days: deploy Web Application Firewall rules targeting SQL injection vectors if your hosting provider supports them, and evaluate replacement customizer solutions (native WordPress Customizer or third-party alternatives with active security maintenance). Within 30 days: migrate to a patched or alternative customization framework, restore from clean backups if database compromise is confirmed, and reconfigure WordPress database service accounts with least-privilege access to limit damage from future injection attacks.

Wordpress Plugin CVE-2026-57726

EUVD-2026-43375 CRITICAL

SQL Injection (CWE-89)

2026-07-13 Patchstack

WordPress SQLi Wordpress Plugin Kirki Themeum

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:44 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue affects Kirki: from n/a through <= 6.0.12.

AnalysisAI

Blind SQL injection in the Themeum Kirki WordPress customizer framework (all versions up to and including 6.0.12) lets remote attackers inject SQL through improperly neutralized special elements, per the CVSS PR:N vector without authentication, to infer and extract database contents. The scope-changed CVSS 3.1 score of 9.3 reflects impact reaching beyond the plugin's own security boundary into the wider WordPress database. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.