CVE-2026-57726: WordPress Kirki plugin <= 6.0.12

Record summary

CVE-2026-57726 has a selected CVSS score of 9.3 (critical).

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue affects Kirki: from n/a through <= 6.0.12.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone

AutomatableYes

Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 13, 2026 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
Kirki Browse Themeum / Kirki Default status: unaffected	CVE List	Through 6.0.12	affected

References

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2026-57726

patchstack.comvdb entry

https://patchstack.com/database/Wordpress/Plugin/kirki/vulnerability/wordpress-kirki-plugin-6-0-12-sql-injection-vulnerability?_s_id=cve