EUVD-2026-71862
GHSA-78r9-6m52-hhpv
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Editor-level auth required (PR:H); read-only SQL exfiltrates cross-user credentials causing scope change (S:C, C:H); no write or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials.
AnalysisAI
SQL injection in the Kirki WordPress plugin (versions 6.0.0 through <6.3.0) enables authenticated users with editor-level access or above to append arbitrary SQL to an unescaped identifier, exfiltrating the full WordPress database including hashed credentials for all user accounts. The scope change (S:C) in the CVSS vector reflects that credential exposure extends impact beyond the attacker's own session to all other platform users. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with editor-level access (the 'editor' role in WordPress, which is above contributor/author but below administrator). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.8 with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N accurately reflects a network-exploitable read-only SQLi that requires editor-level (high-privilege) WordPress authentication - a meaningful real-world barrier on most sites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Kirki plugin to version 6.3.0 or later, which resolves the unescaped SQL identifier. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-Side Request Forgery in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to coerce the s
SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbit
PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users
Stored cross-site scripting in the Kirki WordPress plugin before 6.3.0 allows unauthenticated remote attackers to persis
Arbitrary file upload via malformed archive in the Kirki WordPress customizer plugin (all versions before 6.2.3) allows
Unauthenticated shortcode injection in Kirki WordPress plugin (all versions before 6.2.1) allows any remote attacker to
Object injection in the Themeum Kirki WordPress customizer framework (all versions through 6.0.12) allows attackers to a
Kirki WordPress Customizer Framework plugin before 6.0.14 exposes registered user email addresses, comment author emails
Unauthenticated content disclosure in the Kirki WordPress plugin before 6.3.0 allows any remote attacker to retrieve the
Unauthenticated comment manipulation in the Kirki WordPress plugin (versions before 6.0.12) allows remote attackers to o
Blind SQL injection in the Themeum Kirki WordPress customizer framework (all versions up to and including 6.0.12) lets r
HTML injection in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to embed arbitrary HTML into
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today