CVE-2026-84221 — Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID

CVE-2026-84221

Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID PUBLISHED

Description (CNA)

The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials.

Affected (CNA)

Vendor / product	Versions
Unknown / Kirki	affected 6.0.0 before 6.3.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/6c34da62-46fb-4dd4-a433-bd3df4d9fcfd/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.