Kirki WordPress Plugin CVE-2026-84221

Exploitation requires an authenticated WordPress session with editor-level access (the 'editor' role in WordPress, which is above contributor/author but below administrator). Sites where only trusted staff hold editor roles are largely protected in practice. Exploitation is limited to read operations (SELECT) - no data modification or deletion is possible through this flaw. The vulnerability is constrained to Kirki plugin versions 6.0.0 through <6.3.0 being installed and active. No special server configuration, plugin settings, or non-default WordPress options are required beyond the Kirki plugin being present. Sites where the editor role is granted to external, freelance, or untrusted parties represent the highest-risk deployment pattern.

The CVSS 6.8 with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N accurately reflects a network-exploitable read-only SQLi that requires editor-level (high-privilege) WordPress authentication - a meaningful real-world barrier on most sites. EPSS at 0.15% (5th percentile) corroborates low automated exploitation probability, consistent with the PR:H gate. No KEV listing confirms no observed mass exploitation. However, a public proof-of-concept is available via WPScan, which meaningfully lowers the skill threshold for opportunistic abuse. Real-world risk is elevated on sites with untrusted editors (multi-author publications, freelance contributors, agency-managed sites) where a malicious or compromised editor account could harvest admin credentials and escalate to full site takeover via cracked hashes or session hijack. The I:N metric correctly reflects read-only SQL; the attack cannot directly write data. Net assessment: low automated risk, moderate targeted risk for sites with non-admin editor accounts.

An attacker with a WordPress editor account - obtained through credential stuffing, phishing a site contributor, or by registering on a site with open editor registration - crafts a customizer setting identifier containing a UNION-based SQL payload. Submitting this through the Kirki customizer API endpoint causes the plugin to return database rows, including the wp_users table containing admin password hashes and emails. A publicly available PoC documents the exact request structure. The attacker cracks or relays the admin hash offline and achieves full administrative takeover of the WordPress installation.