# CVE-2026-12721: Kirki WordPress plugin SQL injection

Source: https://junglewise.ai/threats/cve-2026-12721-kirki-wordpress-plugin-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-12721 · Severity: info · CVSS 8.6 · Published 2026-07-31

Kirki, a popular WordPress framework used by developers to build custom themes, contains a security flaw that allows unauthorized individuals to interfere with the website's database. By sending a specially crafted web request, an attacker could potentially steal sensitive user information, modify site content, or gain administrative access. This vulnerability is particularly serious because it does not require the attacker to have a password or any existing account on the site. Owners of WordPress sites using this framework should update to version 6.0.13 or later immediately to protect their data and operations.

Technologies: [Kirki Framework Kirki Customizer Framework](https://junglewise.ai/threats/technologies/kirki-customizer-framework). Vendors: [Kirki Framework](https://junglewise.ai/threats/vendors/kirki-framework).

## Quick answers

**Is CVE-2026-12721 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12721 being exploited in the wild.

**How severe is CVE-2026-12721?** Informational severity, with a CVSS score of 8.6, published 31 July 2026.

**Which products and versions are affected?** Kirki Framework Kirki Customizer Framework before 6.0.13.

**Is there a fix for CVE-2026-12721?** A patch was published on 2026-07-14: Version 6.0.13 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12721 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12721?** Check whether you run Kirki Framework Kirki Customizer Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Kirki WordPress plugin (versions prior to 6.0.13) suffers from a classic SQL injection vulnerability. The root cause is the failure to properly sanitize and escape values retrieved from HTTP requests before incorporating them into SQL queries. An unauthenticated remote attacker can exploit this by sending malicious input to affected endpoints, leading to unauthorized database access, data exfiltration, or potential authentication bypass. The vulnerability is classified as CWE-89. A fix is available in version 6.0.13, which implements proper input validation and parameterization.

## Affected products

- Kirki Kirki Customizer Framework before 6.0.13

## Timeline

- 2026-07-14: disclosed: Initial public disclosure by WPScan
- 2026-07-31: advisory: NVD publication date
- 2026-07-14: patched: Version 6.0.13 released to address the issue

## References

- [https://wpscan.com/vulnerability/4cba3900-9f29-4928-811c-163827358052/](https://wpscan.com/vulnerability/4cba3900-9f29-4928-811c-163827358052/)

## Related threats

- [Kirki WordPress plugin PHP Object Injection](https://junglewise.ai/threats/cve-2026-12720-kirki-wordpress-plugin-php-object-injection)
- [Kirki WordPress plugin SSRF in kirki_get_apis](https://junglewise.ai/threats/cve-2026-13147-kirki-wordpress-plugin-ssrf-in-kirki-get-apis)
- [Kirki WordPress plugin HTML injection in password reset email](https://junglewise.ai/threats/cve-2026-12724-kirki-wordpress-plugin-html-injection-in-password-reset-email)
- [Kirki Freeform Page Builder privilege escalation via account takeover](https://junglewise.ai/threats/cve-2026-8206-kirki-freeform-page-builder-privilege-escalation-via-account)
- [Kirki WordPress Plugin authorization bypass in AJAX forms](https://junglewise.ai/threats/cve-2026-8096-kirki-wordpress-plugin-authorization-bypass-in-ajax-forms)