CVE-2026-12720

HIGH7.5

Kirki < 6.0.13 - Unauthenticated PHP Object Injection

Published Jul 31, 2026

Modified 3 weeks ago

Details

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via another installed Kirki WordPress plugin before 6.0.13, , or an outdated WordPress version), this could be leveraged to perform a variety of attacks, such as remote code execution.

References

DETECTION

https://wpscan.com/vulnerability/22f5af1c-972e-4e31-9afa-bf50ac278c66/

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-12720

CVSS Analysis

CVSS v3.1

7.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

7.5/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Ecosystems

Timeline

PublishedJul 31, 2026

ModifiedJul 31, 2026