CVE-2026-104734
Received Received - Intake

PHP Object Injection in Kirki WordPress Plugin

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: Wordfence

Description
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. By default, Editor-level users are granted FULL_ACCESS to the plugin's import endpoint via the KIRKI_USERS_DEFAULT_FULL_ACCESS configuration, meaning exploitation is possible at Editor privilege level rather than being restricted to administrators alone.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-104734
EUVD
EUVD-2026-103214

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
themeum Kirki – Freeform Page Builder, Website Builder & Customizer 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Kirki plugin for WordPress is vulnerable to PHP Object Injection due to improper deserialization of untrusted input. This flaw allows authenticated attackers with administrator-level access or higher to inject PHP objects. Exploitation requires another plugin or theme with a POP chain to achieve further malicious actions like file deletion, data theft, or code execution.

Detection Guidance

Check for unauthorized file modifications or suspicious activity in WordPress admin logs. Review users with Editor or Administrator privileges for unexpected changes. Inspect plugin files for unexpected deserialization calls or untrusted input handling.

Impact Analysis

If exploited, this vulnerability could allow attackers to delete files, access sensitive data, or execute arbitrary code on your WordPress site. The impact depends on other installed plugins or themes that might provide a POP chain. Editor-level users can also exploit this by default due to the KIRKI_USERS_DEFAULT_FULL_ACCESS setting.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR or HIPAA if an attacker exploits it to retrieve sensitive data or execute code. Since the flaw allows PHP Object Injection with admin or editor access, unauthorized data exposure or modification could violate confidentiality requirements under these regulations.

Mitigation Strategies

Update the Kirki plugin to the latest version if available. Restrict Editor-level user access to only necessary permissions. Disable the plugin if not in use. Monitor for unusual activity and review user roles for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104734. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart