Description
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Kirki | 6.0.0 – < 6.3.0 | 6.3.0 |
References
- https://wpscan.com/vulnerability/6c34da62-46fb-4dd4-a433-bd3df4d9fcfd/ exploit vdb-entry technical-description