A critical SQL Injection vulnerability in the Kirki WordPress plugin allows unauthenticated attackers to gain unauthorized access to database contents.

This is an SQL Injection vulnerability, classified as CWE-89, which permits an unauthenticated attacker to interfere with the queries that an application makes to its database.

The ability to perform SQL Injection allows an attacker to bypass authentication, access sensitive user data, or modify database contents. With a CVSS score of 8.6, this vulnerability represents a severe threat to the confidentiality and integrity of the entire WordPress database, potentially leading to a complete compromise of site data.

Immediate Action: Update the Kirki plugin to version 6.0.13 or later to remediate the SQL injection flaw.

Proactive Monitoring: Monitor database query logs for syntax errors or anomalous queries that deviate from standard application behavior.

Compensating Controls: Utilize a WAF to filter and block malicious SQL injection payloads from reaching the application backend.

Public Exploit Available: No

SQL Injection vulnerabilities are among the most dangerous flaws for web applications. Due to the high CVSS score and the potential for unauthorized data exfiltration, administrators must prioritize updating the Kirki plugin to the latest version immediately.