# CVE-2026-104734: Kirki , Freeform Page Builder PHP Object Injection

Source: https://junglewise.ai/threats/cve-2026-104734-the-kirki-freeform-page-builder-website-builder-customizer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-104734 · Severity: high · CVSS 7.2 · Published 2026-10-17

Kirki is a popular WordPress page builder and customizer plugin used to design website layouts and content. A vulnerability in this plugin allows authenticated users with editor-level privileges (or higher) to inject malicious PHP objects, which could lead to arbitrary file deletion, data theft, or code execution if other vulnerable plugins are present on the site.

Technologies: [Kirki Freeform Page Builder](https://junglewise.ai/threats/technologies/freeform-page-builder). Vendors: [Kirki](https://junglewise.ai/threats/vendors/kirki).

## Quick answers

**Is CVE-2026-104734 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104734 being exploited in the wild.

**How severe is CVE-2026-104734?** High severity, with a CVSS score of 7.2, published 17 October 2026.

**Which products and versions are affected?** Kirki Freeform Page Builder up to and including 6.3.2.

**Is there a fix for CVE-2026-104734?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-104734 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-104734?** Check whether you run Kirki Freeform Page Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin deserializes untrusted input in its import endpoint without proper validation, enabling PHP Object Injection. An authenticated attacker with Editor access can craft malicious serialized objects via the import functionality. Exploitation requires a POP chain present in another installed plugin or theme; without one, the vulnerability has no practical impact. The default KIRKI_USERS_DEFAULT_FULL_ACCESS configuration grants Editor-level users full access to the import endpoint, lowering the required privilege level.

## Affected products

- Kirki Freeform Page Builder up to and including 6.3.2

## Timeline

- 2026-10-17: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.2/includes/Ajax.php](https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.2/includes/Ajax.php)
- [https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.2/includes/Ajax/TemplateExportImport.php](https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.2/includes/Ajax/TemplateExportImport.php)

## Related threats

- [Kirki Freeform Page Builder blind server-side request forgery](https://junglewise.ai/threats/cve-2026-18335-the-kirki-freeform-page-builder-website-builder-customizer-plugin)
- [Kirki Freeform Page Builder Stored XSS in comment parameter](https://junglewise.ai/threats/cve-2026-17037-kirki-freeform-page-builder-stored-xss-in-comment-parameter)