External risk intelligence

Kirki Plugin Blind SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-57726

This vulnerability affects a WordPress plugin. WordPress plugins are commonly deployed as part of public-facing web applications, making the vulnerable code directly reachable via the internet as part of the website's web interface.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability exists in the Kirki WordPress plugin, specifically a type of SQL injection that could allow unauthorized access to sensitive data. While the exact impact is still being assessed, it is important to understand the nature of this threat to assess its relevance to our systems.

Allows attackers to inject malicious SQL commands.
Affects a widely used WordPress plugin.
Confirm relevance and exposure within our environment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted input over the network to a website using the vulnerable Kirki plugin. This input would target a feature within the plugin that improperly handles user-provided data, leading to a blind SQL injection. Successful exploitation could allow an attacker to access sensitive data from the website's database.

No authentication required.
Triggered by sending malicious input.
Risk of sensitive data disclosure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to infer sensitive information from the application's database through blind SQL injection. The impact is contingent on the specific database schema and the application's integration with the Kirki library.

Database information exposure.
Crafted network requests.
Information disclosure from database.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this SQL injection vulnerability in the Kirki plugin. The first practical step involves identifying all instances of the affected plugin, assessing their exposure and business criticality, and then coordinating remediation efforts with the accountable system owners.

Application owners should drive remediation.
Verify plugin reachability and business criticality.
Plan coordinated maintenance for fixes.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Kirki WordPress plugin?

Kirki is a toolkit used by developers to create customizer options for WordPress themes. It simplifies how themes manage settings and styles, often operating behind the scenes to allow users to modify a site's appearance without touching code. Because it is embedded directly into the theme structure, it runs whenever the website processes requests that rely on these theme-specific configuration features.

What does SQL injection mean for CVE-2026-57726?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In plain English, the plugin fails to properly clean or filter data provided by a user before including it in a database query. Because this is a blind SQL injection, an attacker cannot necessarily see the database results directly; instead, they infer information by sending crafted requests and observing how the website responds or changes its behavior.

How is this SQL injection triggered?

An attacker triggers this vulnerability by sending specifically crafted network requests to a website that uses the affected version of the Kirki plugin. No authentication or account login is required to initiate the attack. However, simply visiting the homepage or standard pages is not enough; the malicious input must reach the specific, vulnerable code paths within the plugin that handle data improperly.

Is my website at risk from this vulnerability?

According to Halo Surface Signal, this vulnerability is likely relevant to public-facing systems. Because Kirki is a WordPress plugin, it is typically part of an internet-accessible web interface. If your website uses an affected version of Kirki and is reachable over the internet, it is exposed to remote, unauthenticated requests. Sites that are strictly internal and not connected to a public network face a lower immediate risk.

What should I do if I use the Kirki plugin?

Start by identifying every WordPress installation in your environment that includes the Kirki plugin. Once you have a list, verify which sites are running versions up to 6.0.12. Coordinate with your web administrators to determine the business criticality of these sites and prepare for maintenance. The goal is to address the underlying software weakness by applying official updates as soon as they become available for the plugin.

References

patchstack.com/database/Wordpress/Plugin/kirki/vulnerability/wordpre…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.