What the vulnerability does
01Description
Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12.
CVE-2026-57724
CRITICAL
CVE-2026-57724: WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability
CVSS base score
9.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Explanation of Vulnerability in Simple Terms
02Summary
Kirki versions up to 6.0.12 contain a deserialization vulnerability that allows unauthenticated attackers to run arbitrary code on affected sites. The vulnerability exists in how the plugin processes untrusted serialized data without proper validation. No user interaction is required; an attacker can exploit this remotely over the network.
What an attacker can do
03Attacker Capabilities
Run arbitrary code on the site and take full control of it.
Potential impact on your site
04Site Impact
Complete site compromise: attackers can steal data, modify content, install malware, or take the site offline.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 13, 2026
CVE published
July 13, 2026
Record updated
External resources
07References
Related vulnerabilities
08Related CVE
CVE-2026-49105 WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability
CVE-2026-39481 WordPress Modula Image Gallery plugin <= 2.14.18 - PHP Object Injection vulnerability
CVE-2026-7635 coreActivity: Activity Logging for WordPress <= 3.0 - Unauthenticated PHP Object Injection via 'user_agent' Log Meta Field
CVE-2026-12240 Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field
CVE-2026-8365 Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field
