Quick answers
- Is CVE-2026-84221 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-84221 being exploited in the wild.
- How severe is CVE-2026-84221?
- Medium severity, with a CVSS score of 6.8, published 5 September 2026.
- Which products and versions are affected?
- Kirki Kirki 6.0.0 to 6.2.5.
- Is there a fix for CVE-2026-84221?
- A patch was published on 2026-09-05: Fixed in version 6.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-84221 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-84221?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a SQL injection (CWE-89) in the Content Manager feature of Kirki. An authenticated attacker with editor-level access or above can craft a malicious field ID containing SQL code when creating reference fields in collections. The vulnerable code concatenates this user-supplied identifier directly into SQL queries without parameterization. The injection point is triggered when searching collections with filters applied. An attacker can use time-based blind SQL injection (SLEEP queries) to exfiltrate data or UNION-based injection to directly extract database contents including WordPress user credentials. The plugin concatenates field identifiers while other queries against the same table use proper parameter binding, indicating a localized implementation oversight. Fix: upgrade to version 6.3.0 or later, which implements parameterized queries for all field identifiers.
Affected products
- Kirki Kirki 6.0.0 to 6.2.5
Timeline
- 2026-09-03: disclosed
- 2026-09-05: patched: Fixed in version 6.3.0