Kirki CVE-2026-57726

Themeum Kirki WordPress customizer framework (versions ≤6.0.12) contains an unauthenticated SQL injection vulnerability enabling remote attackers to extract sensitive database contents. With no vendor patch available, any WordPress site running this plugin faces immediate exposure to customer data and internal information theft-regardless of other security measures-until the plugin is removed or replaced.

Within 24 hours: audit all WordPress installations for Kirki versions ≤6.0.12 and immediately disable the plugin; examine database query logs for anomalous SQL patterns that may indicate prior exploitation. Within 7 days: deploy Web Application Firewall rules targeting SQL injection vectors if your hosting provider supports them, and evaluate replacement customizer solutions (native WordPress Customizer or third-party alternatives with active security maintenance). Within 30 days: migrate to a patched or alternative customization framework, restore from clean backups if database compromise is confirmed, and reconfigure WordPress database service accounts with least-privilege access to limit damage from future injection attacks.

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Plugin removal is mandatory-do not delay in expectation of a vendor patch; (2) Enable database query logging and alerting on failed or anomalous SQL statements; (3) Apply WAF rules blocking SQL comment markers and injection strings at the HTTP layer if available through your hosting infrastructure; (4) Implement minimal-privilege database authentication-WordPress application account should not own database objects or grant permissions; (5) establish baseline of database size and row counts; if unexplained changes are detected, assume compromise and execute incident response plan with database restore from known-clean backup. No single control compensates for the plugin's presence-removal remains the primary mitigation.