The Kirki WordPress plugin contains a SQL injection flaw because it fails to escape an attacker-supplied identifier before inserting it into a database query. This flaw permits users with Editor or higher permissions to inject arbitrary SQL code, allowing them to read the entire database, including stored user credentials. The vulnerability is a classic SQL Injection weakness identified as CWE-89.

WordPress sites that have the Kirki plugin installed in any version from 6.0.0 through 6.2.5 are affected, as the plugin is a WordPress component and must be present for the flaw to be exploitable. Based on the description, it is inferred that the plugin operates within the WordPress administration interface.

The CVSS score of 6.8 indicates a moderate-to-high severity, while the EPSS score of under 1% suggests a low current exploitation probability; the vulnerability is not listed in CISA KEV. Exploitation requires an attacker to already possess Editor or higher credentials within the WordPress admin console, which limits the attack surface but still allows potential database compromise. The impact includes credential theft and full database read access.