PHP Object Injection Vulnerability in Kirki Website Builder Plugin for WordPress

CVE-2026-104734

What is CVE-2026-104734?

The Kirki – Freeform Page Builder and Customizer plugin for WordPress is susceptible to PHP Object Injection in all versions up to and including 6.3.2, which occurs due to the deserialization of untrusted input. This vulnerability can be exploited by authenticated users with Editor-level access or greater, enabling them to inject a PHP Object. While it does not directly lead to exploitation without the presence of a PHP Object Pollution (POP) chain in other plugins or themes, it becomes potentially dangerous if such a chain is available. In this scenario, attackers could perform unauthorized actions such as deleting files, accessing sensitive information, or executing arbitrary code. The default settings of the Kirki plugin could expose Editor-level users to greater risks, as they are granted full access to the import endpoint.

References