CVE-2026-12720 Kirki CVE debrief

Who should care

Administrators of WordPress sites using the Kirki plugin should be aware of this vulnerability and take steps to update the plugin and monitor for suspicious activity. They should review plugin functionality and potential gadget chains, and consider compensating controls for exposed systems while remediation is scheduled and verified. Security teams and vulnerability management teams should also be aware of this vulnerability and track exceptions, retest remediated assets, and close the item only after evidence is documented. Operators of affected platforms should prioritize updating the Kirki WordPress plugin to version 6.0.13 or later to prevent potential PHP Object Injection attacks. This requires coordination with relevant stakeholders to ensure timely remediation and minimize potential impact. Monitoring and detection capabilities should be reviewed to ensure they can detect potential exploitation attempts. Asset inventory and configuration management processes should also be reviewed to ensure that affected systems are identified and prioritized for remediation. Rollback and change window processes should be considered to minimize downtime and ensure smooth remediation. Source tracking and verification of remediation should be performed to ensure that the vulnerability is fully remediated. Compensating controls, such as web application firewalls or intrusion detection systems, may be necessary to detect and prevent exploitation attempts while remediation is in progress. Overall, a comprehensive approach is needed to address this vulnerability and minimize potential impact. This includes updating the plugin, reviewing and updating security controls, and ensuring that affected systems are properly configured and monitored. By taking these steps, organizations can reduce the risk of exploitation and protect their systems from potential attacks. In addition, it is essential to review and update incident response plans to ensure that they are prepared to respond to potential exploitation attempts. This includes identifying and training incident response teams, developing communication plans, and establishing procedures for containment, eradication, recovery, or

Technical summary

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site, this could be leveraged to perform a variety of attacks, such as remote code execution. The vulnerability affects WordPress sites using the Kirki plugin and requires an administrator to review the stored data to trigger the attack.

Defensive priority

Administrators should prioritize updating the Kirki WordPress plugin to version 6.0.13 or later to prevent potential PHP Object Injection attacks.

Recommended defensive actions

• Update the Kirki WordPress plugin to version 6.0.13 or later
• Review plugin functionality and potential gadget chains
• Monitor for suspicious activity related to the Kirki plugin
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection. With a suitable gadget chain present on the site, this could be leveraged to perform a variety of attacks, such as remote code execution. Evidence is limited; further review of plugin functionality and potential gadget chains is recommended.

Official resources