CVE-2026-84221
Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID
MEDIUM 6.8EPSS 0.4%
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials.
- Affected
- Kirki
- CVSS v3.1 CNA
- 6.8 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - EPSS
- 0.40% chance of exploitation in the next 30 days, 32nd percentile
- Published
- 2026-09-05
- Updated
- 2026-09-06