CVE-2026-12720
Received Received - Intake

PHP Object Injection in Kirki WordPress Plugin

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: WPScan

Description
The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via another installed Kirki WordPress plugin before 6.0.13, , or an outdated WordPress version), this could be leveraged to perform a variety of attacks, such as remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-12720
EUVD
EUVD-2026-51431

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aristath kirki to 6.0.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Kirki WordPress plugin before version 6.0.13 has a vulnerability where it does not properly restrict which PHP classes can be created during deserialization of user-controlled data. This allows unauthenticated users to store malicious serialized data, which when reviewed by an administrator triggers a PHP Object Injection attack. If a suitable gadget chain exists on the site, this could lead to remote code execution.

Detection Guidance

To detect this vulnerability, check the installed version of the Kirki WordPress plugin. If it is below 6.0.13, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly.

Impact Analysis

This vulnerability allows unauthenticated attackers to potentially execute arbitrary code on your WordPress site if an administrator reviews the malicious data. It could lead to full site compromise, data theft, or further malware infections. The impact depends on the presence of a gadget chain, which may exist in outdated WordPress versions or other plugins.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection. A successful exploit may result in data breaches, triggering mandatory breach notifications and potential fines under these regulations.

Mitigation Strategies

Update the Kirki WordPress plugin to version 6.0.13 or later to address the PHP Object Injection vulnerability. Ensure WordPress core and all plugins are updated to their latest versions to prevent exploitation through gadget chains.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12720. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart