Object Injection Vulnerability in Themeum Kirki by Themeum
CVE-2026-57724

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Kirki
Vendor
CVE Published:
13 July 2026

What is CVE-2026-57724?

A vulnerability has been identified in the Themeum Kirki plugin that allows for object injection through deserialization of untrusted data. This security flaw can potentially permit attackers to execute malicious actions on affected WordPress installations. The issue impacts all versions of Kirki up to 6.0.12, necessitating immediate attention to secure the application and safeguard user data.

Affected Version(s)

Kirki 0 <= 6.0.12

References

https://patchstack.com/database/Wordpress/Plugin/kirki/vu...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

VanTastic | Patchstack Bug Bounty Program
.