A critical SQL injection vulnerability in the Themeum Kirki WordPress plugin allows unauthenticated attackers to potentially access sensitive database information.

This is a Blind SQL Injection flaw (CWE-89) arising from improper neutralization of special elements in SQL commands. The vulnerability is accessible to unauthenticated remote attackers (AV:N/PR:N).

The ability for an unauthenticated attacker to perform Blind SQL injection poses a severe risk to data confidentiality. Attackers could potentially exfiltrate sensitive information from the underlying database, leading to significant privacy breaches and regulatory non-compliance. With a CVSS score of 9.3, this vulnerability represents a critical threat to the integrity of the application's data layer.

Immediate Action: Upgrade the Kirki plugin to the latest available version provided by the vendor. If a patch is not yet available, consider deactivating the plugin until a secure version is released.

Proactive Monitoring: Monitor database query logs for unusual patterns, such as repetitive syntax errors or unexpected data retrieval requests, which may indicate automated injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads targeted at WordPress plugins.

Public Exploit Available: Unknown

Given the critical CVSS severity and the unauthenticated nature of this vulnerability, immediate action is required. Organizations using the Kirki plugin should audit their environment for the affected versions and prioritize patching or disabling the component to prevent potential data exfiltration.