Executive brief
Kirki is a popular WordPress plugin for managing custom content and settings. A SQL injection flaw in versions before 6.3.0 allows WordPress editors and higher-privileged users to inject arbitrary SQL queries through unescaped field identifiers, potentially exposing the entire WordPress database including user credentials, password hashes, and sensitive content.
Technical details
The vulnerability is a SQL injection (CWE-89) in the Content Manager feature of Kirki. An authenticated attacker with editor-level access or above can craft a malicious field ID containing SQL code when creating reference fields in collections. The vulnerable code concatenates this user-supplied identifier directly into SQL queries without parameterization. The injection point is triggered when searching collections with filters applied. An attacker can use time-based blind SQL injection (SLEEP queries) to exfiltrate data or UNION-based injection to directly extract database contents including WordPress user credentials. The plugin concatenates field identifiers while other queries against the same table use proper parameter binding, indicating a localized implementation oversight. Fix: upgrade to version 6.3.0 or later, which implements parameterized queries for all field identifiers.
Affected products
- Kirki Kirki 6.0.0 to 6.2.5
Timeline
- 2026-09-03: disclosed
- 2026-09-05: patched: Fixed in version 6.3.0