Quick answers
- Is CVE-2026-12721 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-12721 being exploited in the wild.
- How severe is CVE-2026-12721?
- Informational severity, with a CVSS score of 8.6, published 31 July 2026.
- Which products and versions are affected?
- Kirki Framework Kirki Customizer Framework before 6.0.13.
- Is there a fix for CVE-2026-12721?
- A patch was published on 2026-07-14: Version 6.0.13 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-12721 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-12721?
- Check whether you run Kirki Framework Kirki Customizer Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Kirki WordPress plugin (versions prior to 6.0.13) suffers from a classic SQL injection vulnerability. The root cause is the failure to properly sanitize and escape values retrieved from HTTP requests before incorporating them into SQL queries. An unauthenticated remote attacker can exploit this by sending malicious input to affected endpoints, leading to unauthorized database access, data exfiltration, or potential authentication bypass. The vulnerability is classified as CWE-89. A fix is available in version 6.0.13, which implements proper input validation and parameterization.
Affected products
- Kirki Kirki Customizer Framework before 6.0.13
Timeline
- 2026-07-14: disclosed: Initial public disclosure by WPScan
- 2026-07-31: advisory: NVD publication date
- 2026-07-14: patched: Version 6.0.13 released to address the issue