# CVE-2026-12720: Kirki WordPress plugin PHP Object Injection

Source: https://junglewise.ai/threats/cve-2026-12720-kirki-wordpress-plugin-php-object-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-12720 · Severity: info · CVSS 7.5 · Published 2026-07-31

Kirki, a popular WordPress framework used by developers to build themes, contains a security flaw that allows unauthorized users to inject malicious data into a website. This data remains dormant until a site administrator views it, at which point the malicious code is triggered. If successful, an attacker could potentially take full control of the website, steal sensitive information, or disrupt operations.

Technologies: [Kirki Framework Kirki Customizer Framework](https://junglewise.ai/threats/technologies/kirki-customizer-framework). Vendors: [Kirki Framework](https://junglewise.ai/threats/vendors/kirki-framework).

## Quick answers

**Is CVE-2026-12720 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12720 being exploited in the wild.

**How severe is CVE-2026-12720?** Informational severity, with a CVSS score of 7.5, published 31 July 2026.

**Which products and versions are affected?** Kirki Framework Kirki Customizer Framework < 6.0.13.

**Is there a fix for CVE-2026-12720?** A patch was published on 2026-07-31: Fixed in version 6.0.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12720 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12720?** Check whether you run Kirki Framework Kirki Customizer Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Kirki WordPress plugin fails to restrict class instantiation during the deserialization of data provided by unauthenticated users. This leads to a PHP Object Injection vulnerability (CWE-502). The attack is a two-stage process: first, an unauthenticated user stores a serialized object; second, the object is deserialized when an administrator reviews the stored data (requiring user interaction). If a suitable gadget chain is available—either within Kirki itself, another installed plugin/theme, or the WordPress core—an attacker can achieve remote code execution (RCE). The issue is resolved in version 6.0.13.

## Affected products

- Kirki Kirki < 6.0.13

## Timeline

- 2026-07-14: disclosed: Publicly published via WPScan
- 2026-07-31: advisory: NVD published date
- 2026-07-31: patched: Fixed in version 6.0.13

## References

- [https://wpscan.com/vulnerability/22f5af1c-972e-4e31-9afa-bf50ac278c66/](https://wpscan.com/vulnerability/22f5af1c-972e-4e31-9afa-bf50ac278c66/)

## Related threats

- [Kirki WordPress plugin SQL injection](https://junglewise.ai/threats/cve-2026-12721-kirki-wordpress-plugin-sql-injection)
- [Kirki WordPress plugin SSRF in kirki_get_apis](https://junglewise.ai/threats/cve-2026-13147-kirki-wordpress-plugin-ssrf-in-kirki-get-apis)
- [Kirki WordPress plugin HTML injection in password reset email](https://junglewise.ai/threats/cve-2026-12724-kirki-wordpress-plugin-html-injection-in-password-reset-email)
- [Kirki Freeform Page Builder privilege escalation via account takeover](https://junglewise.ai/threats/cve-2026-8206-kirki-freeform-page-builder-privilege-escalation-via-account)
- [Kirki WordPress Plugin authorization bypass in AJAX forms](https://junglewise.ai/threats/cve-2026-8096-kirki-wordpress-plugin-authorization-bypass-in-ajax-forms)