BaseFortify

Executive Summary

CVE-2026-57724 is a PHP Object Injection vulnerability found in the WordPress Kirki Plugin versions 6.0.12 and earlier. It arises from the deserialization of untrusted data, which allows attackers to inject malicious objects into the application.

This vulnerability can be exploited if a suitable POP (Property Oriented Programming) chain exists, enabling attackers to perform various malicious actions such as code injection, SQL injection, path traversal, and denial of service.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability has a high severity score of 9.8, indicating it poses a significant risk. If exploited, attackers can execute arbitrary code, manipulate databases via SQL injection, access unauthorized files through path traversal, or cause denial of service, potentially compromising the entire website.

Such impacts can lead to data breaches, website defacement, service outages, and loss of user trust.

Immediate mitigation involves updating the Kirki plugin to version 6.0.13 or later or applying provided mitigation rules to block attacks until the update is applied.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate action is required to mitigate the risk of this high-priority PHP Object Injection vulnerability in the WordPress Kirki Plugin (versions 6.0.12 and earlier).

• Update the Kirki plugin to version 6.0.13 or later.
• If updating immediately is not possible, apply the mitigation rule provided by Patchstack to block attacks until the plugin is updated.
• Seek assistance from your hosting provider or a web developer to help implement these mitigations.

Useful 0 Not Useful 0