CVE-2026-12720 in Kirki Plugin
Summary
by MITRE • 07/31/2026
The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via another installed Kirki WordPress plugin before 6.0.13, , or an outdated WordPress version), this could be leveraged to perform a variety of attacks, such as remote code execution.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/31/2026
The vulnerability in Kirki WordPress plugin versions prior to 6.0.13 represents a critical PHP Object Injection flaw that exploits improper data deserialization practices within the plugin's architecture. This vulnerability occurs when unauthenticated users can store serialized data that later gets deserialized by administrators, creating an attack vector where maliciously crafted objects can be instantiated during the review process. The issue stems from insufficient validation of class names during the unserialize operation, allowing attackers to specify arbitrary classes for instantiation. According to CWE-502, this maps directly to the weakness of deserializing untrusted data without proper class validation, which is a well-documented pattern that has led to numerous high-profile exploitation scenarios in web applications.
The operational impact of this vulnerability extends far beyond simple data manipulation, as it creates a privilege escalation pathway where unauthenticated attackers can potentially execute arbitrary code on vulnerable WordPress installations. When administrators review stored data containing malicious serialized objects, the PHP deserialization process automatically instantiates these objects, triggering their constructors and potentially executing malicious code within the context of the web server. The attack becomes particularly dangerous when combined with other vulnerable components within the WordPress ecosystem, as the presence of suitable gadget chains in other plugins or outdated WordPress core versions can amplify the exploitation potential. This aligns with ATT&CK technique T1059.007 for Python and T1566 for malicious file downloads, where the injection occurs during data processing rather than direct execution.
The security implications become more severe when considering that WordPress administrators often have elevated privileges and access to sensitive system resources. The vulnerability allows attackers to leverage the administrator's session context to perform actions that would otherwise be restricted, including but not limited to file manipulation, database access, and potential command execution on the underlying server. The attack chain typically involves crafting serialized objects with specific class names that contain malicious code within their __wakeup() or __construct() methods, which are automatically called during deserialization. Organizations should implement immediate mitigations such as updating to Kirki plugin version 6.0.13 or later, which includes proper class validation during deserialization processes, along with monitoring for suspicious serialized data patterns in user-generated content and implementing web application firewalls that can detect and block malicious serialization attempts. Additionally, regular security audits of installed plugins and core WordPress versions should be conducted to identify potential gadget chains that could be exploited in combination with this vulnerability.