PHP Object Injection in Kirki WordPress Plugin by DevJunkie
CVE-2026-12720
Key Information:
Badges
What is CVE-2026-12720?
The Kirki WordPress plugin, prior to version 6.0.13, fails to adequately restrict the classes that can be instantiated when it deserializes data stored by unauthenticated users. This oversight creates a path for PHP Object Injection, which can be exploited when an administrator later reviews the stored data. If a suitable gadget chain exists on the site, either through an earlier version of the Kirki plugin or other outdated WordPress components, the vulnerability potentially allows an attacker to execute arbitrary code remotely, compromising the site's integrity.
Affected Version(s)
Kirki 0 < 6.0.13
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.