Executive brief
Kirki, a popular WordPress framework used by developers to build custom themes, contains a security flaw that allows unauthorized individuals to interfere with the website's database. By sending a specially crafted web request, an attacker could potentially steal sensitive user information, modify site content, or gain administrative access. This vulnerability is particularly serious because it does not require the attacker to have a password or any existing account on the site. Owners of WordPress sites using this framework should update to version 6.0.13 or later immediately to protect their data and operations.
Technical details
The Kirki WordPress plugin (versions prior to 6.0.13) suffers from a classic SQL injection vulnerability. The root cause is the failure to properly sanitize and escape values retrieved from HTTP requests before incorporating them into SQL queries. An unauthenticated remote attacker can exploit this by sending malicious input to affected endpoints, leading to unauthorized database access, data exfiltration, or potential authentication bypass. The vulnerability is classified as CWE-89. A fix is available in version 6.0.13, which implements proper input validation and parameterization.
Affected products
- Kirki Kirki Customizer Framework before 6.0.13
Timeline
- 2026-07-14: disclosed: Initial public disclosure by WPScan
- 2026-07-31: advisory: NVD publication date
- 2026-07-14: patched: Version 6.0.13 released to address the issue