CVE-2026-84221

SHODAN_DORKS

["http.html:"wp-content/plugins/kirki"", "http.html:"kirki-toolkit"", "http.title:"WordPress" http.html:"kirki""]

Executive Summary

CVE-2026-84221 is an unauthenticated/privileged SQL injection vulnerability in the Kirki WordPress plugin, affecting all versions prior to 6.3.0. The flaw resides in the plugin's failure to escape a user-supplied identifier before its use in a SQL query, which allows users with editor-level access and above to append arbitrary SQL statements and read the contents of the underlying database, including stored user credentials. The plugin is widely deployed as a WordPress customizer framework, meaning the exposure extends across numerous theme and page-builder ecosystems that bundle Kirki. With no patch confidence (0/4) from tracked sources, no public proof-of-concept, and no CISA KEV listing, the immediate risk is moderate but escalates significantly if the plugin is present on internet-facing WordPress installations with editor-level accounts compromised or maliciously created.

Technical Analysis

The NVD description identifies a classic client-side SQL injection vulnerability class (CWE-89) triggered through an unescaped user-supplied identifier. The affected component is the Kirki WordPress plugin's database interaction layer — most commonly associated with the customizer settings framework, where the plugin stores and retrieves configuration values in the wp_options or custom tables using identifiers derived from user-supplied input (e.g., setting IDs, field names, or option keys).

Vulnerability mechanism (class-level): The application constructs a SQL query by concatenating a user-controlled identifier (likely a setting key, control ID, or AJAX request parameter) directly into the query string without parameterization or escaping. When a user with editor-level access or higher submits a crafted value for this identifier, the value terminates the intended SQL statement and appends arbitrary SQL clauses (e.g., UNION SELECT, OR 1=1, or stacked queries, depending on the database driver). The insufficient technical detail in the NVD description does not specify the exact endpoint, function name, or table structure — therefore, no specific code-level identifiers should be assumed beyond the class-level mechanism.

Attack surface: The vulnerability is reachable only by authenticated users with edit_posts capabilities (editor role and above, including administrators). The attack vector is HTTP-based, likely via the WordPress admin AJAX handler or customizer save endpoint, where the plugin processes identifiers submitted in POST parameters. Since the plugin is a framework dependency for numerous themes, the vulnerable code may execute in both the admin panel and front-end customizer contexts, expanding the request surface to any endpoint that triggers Kirki's database read/write routines.

Notable limitation: Because the NVD description does not enumerate the specific SQL query structure, affected tables, or the exact function responsible, analysis must remain at the class level. The impact — reading user credentials — strongly implies the injection occurs in a query that does not use WordPress's $wpdb->prepare() method, which would have enforced proper escaping of the identifier parameter.

Exploitation Scenarios

No public PoC or exploit code is available; the following attack chain is inferred from the vulnerability class and NVD description.

Step 1 — Reconnaissance and target identification: An attacker first identifies WordPress sites running a vulnerable Kirki version. This is achievable via HTTP fingerprinting (e.g., reading /wp-content/plugins/kirki/readme.txt for the version string) or via search engine dorks (inurl:"wp-content/plugins/kirki"). Shodan queries can also index such sites using the dorks listed above.

Step 2 — Access establishment (must precede exploitation): The attacker needs valid credentials for an account with at least editor-level privileges. This could be obtained via prior credential-stuffing campaigns, phishing, or a separate WordPress core/user enumeration vulnerability. Notably, the vulnerability itself does not bypass authentication — it amplifies the impact of already-compromised low-privilege accounts.

Step 3 — Flaw trigger and payload execution: Once authenticated as an editor, the attacker navigates to the WordPress customizer or the specific admin page that invokes Kirki's database query. The attacker submits a crafted identifier (e.g., a setting ID field) containing a SQL injection payload typical for time-based or UNION-based exfiltration, such as: valid_id' UNION SELECT user_login, user_pass FROM wp_users-- -. Since the application does not escape this identifier, the injected SQL is appended to the backend query.

Step 4 — Post-exploitation impact: The query results are returned to the attacker, either rendered in the response body (error-based/UNION-based) or inferred via response timing (blind SQLi). Successful extraction of the wp_users table yields username and password hashes (MD5-based phpass hashes for older installs, bcrypt for newer). These hashes can be cracked offline (e.g., with hashcat) or used in pass-the-hash style attacks against the WordPress admin account. With administrator access, the attacker can upload a malicious plugin, establish a webshell, pivot to the server, and achieve full remote code execution.

Impact Assessment

Confidentiality impact: High. The core impact is unauthorized disclosure of the entire WordPress database, including wp_users (credentials), wp_options (site configuration, which may contain API keys and integration secrets), wp_posts (private/draft content), and any custom tables created by themes or other plugins. Given that many sites reuse passwords across services, credential theft may facilitate lateral movement beyond WordPress.

Integrity impact: Low (direct). The vulnerability is read-oriented per the description; however, depending on the database user's privileges (often DB_USER with full CRUD on the WordPress schema), stacked queries could be used to insert malicious admin users or modify site content via secondary injection.

Availability impact: Low. No denial-of-service is described; however, an attacker could theoretically drop tables if the DB user has adequate privileges, though this is not the primary described impact.

Affected systems and blast radius: Any WordPress site running Kirki < 6.3.0. The plugin is a dependency of thousands of free and commercial themes (e.g., themes by ThemeGrill, aThemes, etc.), meaning the blast radius spans tens of thousands of sites. Because exploitation requires editor-level access, the exposed population is limited to sites that have already been partially compromised; yet the severity is high because editor accounts are common in multi-author blogs and business sites.

CVSS: N/A (no score provided). Based on the class of vulnerability, if scored under CVSS 3.1 with PR:L/UI:N/S:U/C:H/I:N/A:N, the score would approximate 6.5 (Medium) — but this is an analyst estimate and must not be used as an official score. The absence of an official score should be treated as information uncertainty, not risk reduction.

Detection Guidance

Sigma Rule

title: Kirki WordPress Plugin SQL Injection (CVE-2026-84221)
id: 4c9d3f8a-1b2c-4d5e-9f0a-2b3c4d5e6f70
status: experimental
description: Detects SQL injection attempts targeting the Kirki plugin's unescaped identifier parameter in WordPress.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-84221
author: vartersit.com Threat Intel
date: 2026/05/01
logsource:
    category: webserver
    product: apache
    detection:
        selection_a:
            cs-method: 'POST'
            cs-uri-query|contains:
                - 'admin-ajax.php'
                - 'customize.php'
            cs-uri-query|contains|all:
                - 'action=kirki_'
        selection_b:
            cs-uri-query|contains:
                - 'union+select'
                - 'union%20select'
                - 'sleep('
                - 'benchmark('
                - "' or 1=1 --"
                - "0x3a"  # hex-encoded colon used in stacked queries
        condition: selection_a and selection_b
    level: high
    falsepositives:
        - Security scanners
        - Legitimate use of special characters in setting names (unlikely)
    fields:
        - client_ip
        - user_agent
        - cs-uri-query

YARA Rule

rule Kirki_WP_SQLi_Payloads_CVE_2026_84221 {
    meta:
        author      = "valtersit.com Threat Intel"
        date        = "2026-05-01"
        description = "Detects SQL injection payloads in web traffic or logs targeting the Kirki WordPress plugin identifier parameter"
        reference   = "CVE-2026-84221"
        severity    = "high"
        cve         = "CVE-2026-84221"
    strings:
        $s1 = "action=kirki_" ascii wide
        $s2 = "wp-content/plugins/kirki" ascii wide
        $s3 = "union select" ascii wide nocase
        $s4 = "union%20select" ascii wide nocase
        $s5 = "sleep(" ascii wide nocase
        $s6 = "benchmark(" ascii wide nocase
        $s7 = "information_schema.tables" ascii wide nocase
        $s8 = "wp_users" ascii wide nocase
        $s9 = "user_pass" ascii wide nocase
    condition:
        uint16(0) == 0x3C3C or uint16(0) == 0x3C21  // HTML response OR log file start
        and any of ($s1*) and any of ($s2*)
        and any of ($s3* or $s4* or $s5* or $s6* or $s7* or $s8* or $s9*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-84221 Kirki WordPress Plugin SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; nocase; content:"action=kirki_"; http_uri; nocase; pcre:"/(union\s+select|sleep\s*\(|benchmark\s*\(|information_schema|wp_users)/iR"; classtype:web-application-attack; reference:cve,2026-84221; sid:10084221; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where event.category == "network" and destination.port == 80
    and http.request.method == "POST"
    and url.path in ("/wp-admin/admin-ajax.php", "/wp-admin/customize.php")
    and url.query like~ "*action=kirki_*" ]
  [ network where event.category == "network" and destination.port == 80
    and (http.request.body.content like~ "*union*select*"
      or http.request.body.content like~ "*sleep(*"
      or http.request.body.content like~ "*benchmark(*"
      or http.request.body.content like~ "*wp_users*"
      or http.request.body.content like~ "*information_schema*") ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST"
| search uri_path IN ("/wp-admin/admin-ajax.php", "/wp-admin/customize.php")
| search uri_query IN ("*action=kirki_*")
| regex _raw="(?i)(union\s+select|sleep\s*\(|benchmark\s*\(|wp_users|information_schema)"
| table _time, clientip, user, uri_query, _raw
| stats count by clientip, uri_query
| sort - count

Wazuh OSSEC Rule

<group name="wordpress, sql_injection,">
    <rule id="100842" level="12">
        <decoded>POST</decoded>
        <match>admin-ajax.php|customize.php</match>
        <match>action=kirki_</match>
        <regex>(?i)(union\s+select|sleep\s*\(|benchmark\s*\(|wp_users|information_schema)</regex>
        <description>CVE-2026-84221: Possible SQL injection attempt against Kirki WordPress plugin</description>
        <group>web_application_attack,sql_injection,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

⚠ Patch confidence: 0/4 — UNPATCHED. No vendor advisory, no source code patch, and no official fix has been confirmed from any tracked source at the time of writing. The NVD states the fix is in version 6.3.0, but independent verification of the patch's existence and completeness is absent. Treat any site running a version below 6.3.0 as vulnerable.

1) Immediate mitigations (compensating controls):

• Restrict editor roles: If the site does not require multiple authors, remove editor-level accounts or downgrade them to "Author" or "Contributor" roles, which do not have the privileges needed to reach the vulnerable query. This reduces the attack surface to a smaller set of trusted users.
• Enforce MFA on all editor and administrator accounts to prevent credential compromise that would enable exploitation.
• Web Application Firewall (WAF): Deploy rules that block requests containing SQLi payload signature strings (union select, sleep(, benchmark() in any POST parameter that targets admin-ajax.php or customize.php with action=kirki_ parameters.
• Database hardening: Ensure the WordPress database user has the minimum required privileges (e.g., no FILE, no GRANT, ideally read/write to only the WordPress schema). This limits the blast radius if stacked queries are possible.

2) Patch/upgrade steps:

• Monitor for Kirki 6.3.0 release confirmation from the vendor (kirki.org / GitHub repository kirki-framework). Verify release notes explicitly reference a security fix for SQL injection.
• When upgrading: update the Kirki plugin via the WordPress admin panel (Plugins → Installed Plugins → Kirki → Update Now), or via wp-cli: wp plugin update kirki.
• Because Kirki is often bundled inside themes and frameworks as a bundled/embedded library, check whether your active theme has vendored copies of Kirki. Check /wp-content/themes/<theme>/inc/kirki/ for bundled versions and update the theme or replace with the standalone plugin version.
• After upgrade, verify the plugin version in readme.txt shows 6.3.0 or higher.

3) Long-term hardening:

• Vulnerability management hygiene: Subscribe to WordPress plugin security feeds (e.g., Patchstack, WPScan) to get advance notice of vulnerabilities in framework plugins like Kirki.
• Least-functionality enforcement: If the site does not actively use the Kirki customizer features, consider disabling or removing the plugin entirely. If deactivation is not viable, disable the vulnerable AJAX actions via a custom mu-plugin that removes the wp_ajax_nopriv_ and wp_ajax_ actions for kirki_* endpoints.
• Periodic privilege audits: Regularly review WordPress user roles to remove stale editor/administrator accounts.
• Harden WordPress administrator access further via IP allowlisting for the wp-admin directory to reduce the remote attack reach for authenticated-flaw exploitation.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-84221 — Official CVE record with the NVD description and references (sparse; CWE and CVSS unassigned).
2. Kirki Official Site / GitHub: https://github.com/kirki-framework/kirki — Repository where version 6.3.0 release notes and patch commits should appear. Monitor this for patch confirmation.
3. WPScan Vulnerability Database: https://wpscan.com/wordpresses/ — Third-party WordPress vulnerability repository that may carry additional technical details once the CVE is indexed.
4. Patchstack Threat Library: https://patchstack.com/database/ — WordPress-specific vulnerability intelligence; check for concurrent disclosures or public PoC.

Known threat actor campaigns or exploit-in-the-wild evidence: None reported as of this writing. The vulnerability was disclosed with no CISA KEV listing and no observed exploitation activity in open-source or commercial threat intelligence feeds. The absence of a patch and of public PoC contributes to the low signal for exploitation; however, history with WordPress plugin SQLi (e.g., CVE-2023-3460 in Ultimate Member) suggests that weaponization typically follows within weeks of a public disclosure. SOC teams should prioritize detection rules above even in the absence of confirmed in-the-wild activity.