CVE-2026-12721
Kirki < 6.0.13 - Unauthenticated SQL Injection
CVSS Score
8.6
EPSS Score
0.2%
EPSS Percentile
7th
The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
| Vendor | unknown |
| Product | kirki |
| Published | Jul 31, 2026 |
| Last Updated | Jul 31, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown kirki
Be the first to know when new high vulnerabilities affecting unknown kirki are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Kirki
0 < 6.0.13
References
Credits
Hermanhms WPScan