Description
The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Kirki | < 6.0.13 | 6.0.13 |
References
- https://wpscan.com/vulnerability/4cba3900-9f29-4928-811c-163827358052/ exploit vdb-entry technical-description