The Kirki WordPress plugin before version 6.0.13 fails to properly sanitise and escape a value obtained from an HTTP request before inserting it into a SQL statement, thereby allowing an unauthenticated attacker to perform SQL injection. By crafting a malicious request to the plugin endpoint, an attacker can execute arbitrary SQL commands against the underlying database, potentially reading, modifying or deleting site data.

WordPress sites that use the Kirki plugin with a version older than 6.0.13 are affected; any WordPress installation that has the plugin enabled is at risk if the plugin code is not updated.

The vulnerability can be exploited remotely over the network with no authentication; the attacker only needs to submit a specially formed request to the plugin endpoint. The CVSS score of 8.6 indicates high severity, and the EPSS score of less than 1% suggests a low exploitation probability. The vulnerability is not listed in CISA KEV. An attacker who successfully injects SQL could read, modify, or delete site data, thereby compromising the confidentiality and integrity of the website.