SEPTEMBER 20, 2026
Live Feed
Back to database
Case File

CVE-2026-12721

HIGH · CVSS 8.6 EPSS 0.26%

Source: NVD + CISA KEV + EPSS · Published 2026-07-31 · Last synced 2026-08-30

CyberRota Analysis

AI-Generated

The Kirki WordPress plugin prior to version 6.0.13 is vulnerable to SQL injection due to inadequate sanitization and escaping of user input in SQL statements. This flaw allows unauthenticated attackers to manipulate database queries, potentially leading to data exposure or corruption. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk of exploitation.

CVE
CVE-2026-12721
Severity
HIGH
CVSS
8.6
EPSS
0.26%
WordPress

Original NVD Description

The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.