Quick answers
- Is CVE-2026-12720 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-12720 being exploited in the wild.
- How severe is CVE-2026-12720?
- Informational severity, with a CVSS score of 7.5, published 31 July 2026.
- Which products and versions are affected?
- Kirki Framework Kirki Customizer Framework < 6.0.13.
- Is there a fix for CVE-2026-12720?
- A patch was published on 2026-07-31: Fixed in version 6.0.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-12720 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-12720?
- Check whether you run Kirki Framework Kirki Customizer Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Kirki WordPress plugin fails to restrict class instantiation during the deserialization of data provided by unauthenticated users. This leads to a PHP Object Injection vulnerability (CWE-502). The attack is a two-stage process: first, an unauthenticated user stores a serialized object; second, the object is deserialized when an administrator reviews the stored data (requiring user interaction). If a suitable gadget chain is available—either within Kirki itself, another installed plugin/theme, or the WordPress core—an attacker can achieve remote code execution (RCE). The issue is resolved in version 6.0.13.
Affected products
- Kirki Kirki < 6.0.13
Timeline
- 2026-07-14: disclosed: Publicly published via WPScan
- 2026-07-31: advisory: NVD published date
- 2026-07-31: patched: Fixed in version 6.0.13