Executive brief
Kirki, a popular WordPress framework used by developers to build themes, contains a security flaw that allows unauthorized users to inject malicious data into a website. This data remains dormant until a site administrator views it, at which point the malicious code is triggered. If successful, an attacker could potentially take full control of the website, steal sensitive information, or disrupt operations.
Technical details
The Kirki WordPress plugin fails to restrict class instantiation during the deserialization of data provided by unauthenticated users. This leads to a PHP Object Injection vulnerability (CWE-502). The attack is a two-stage process: first, an unauthenticated user stores a serialized object; second, the object is deserialized when an administrator reviews the stored data (requiring user interaction). If a suitable gadget chain is available—either within Kirki itself, another installed plugin/theme, or the WordPress core—an attacker can achieve remote code execution (RCE). The issue is resolved in version 6.0.13.
Affected products
- Kirki Kirki < 6.0.13
Timeline
- 2026-07-14: disclosed: Publicly published via WPScan
- 2026-07-31: advisory: NVD published date
- 2026-07-31: patched: Fixed in version 6.0.13