CVE-2026-57726: WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerability
Published Jul 13, 2026
·Updated
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue affects Kirki: from n/a through <= 6.0.12.
Affected Software
1 affected component
kirki<=6.0.12
Event History
Jul 13, 2026
CVE Published
via MITRE·08:41 AM
Data Sourced
via MITRE·08:41 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-57726?
CVE-2026-57726 has a severity rating of critical with a score of 9.3.
2
How does CVE-2026-57726 exploit SQL Injection vulnerabilities?
CVE-2026-57726 allows for blind SQL injection through improper neutralization of special elements in SQL commands.
3
What versions of the Kirki plugin are affected by CVE-2026-57726?
CVE-2026-57726 affects all versions of the Kirki plugin from n/a up to and including version 6.0.12.
4
How can I fix the vulnerability CVE-2026-57726 in the Kirki plugin?
To fix CVE-2026-57726, update your Kirki plugin to a version later than 6.0.12.
5
What are the potential impacts of CVE-2026-57726 on WordPress sites?
Exploiting CVE-2026-57726 could allow attackers to execute unauthorized SQL commands, exposing sensitive data on WordPress sites.