The Themeum Kirki plugin suffers from an SQL Injection vulnerability (CVE-2026-57726) caused by improper neutralization of special elements in SQL commands. This flaw enables Blind SQL Injection attacks, potentially allowing an unauthenticated attacker to extract sensitive information from the database. The issue affects all versions of Kirki up to and including 6.0.12. There is no vendor advisory or patch currently available, and no known exploits have been reported in the wild as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to perform Blind SQL Injection, leading to unauthorized disclosure of sensitive data. The CVSS score of 9.3 reflects a critical impact on confidentiality with no impact on integrity and a low impact on availability. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the Kirki plugin to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.