CVE-2026-104734 themeum CVE debrief

Who should care

WordPress administrators and security teams should assess exposure and verify the presence of POP chains in installed plugins and themes. They should also restrict access to the plugin's import endpoint to trusted users only and monitor for suspicious activity related to the plugin's import functionality. Additionally, they should review compensating controls for exposed systems and check relevant monitoring, detection, and logs for exposed assets that may

Why it matters

CVE-2026-104734 allows authenticated attackers to inject PHP Objects, potentially leading to arbitrary file deletion, sensitive data retrieval, or code execution if a POP chain is present in another plugin or theme.

• Verify presence of POP chain in installed plugins and themes to determine potential impact.
• Restrict access to the plugin's import endpoint to trusted users only.
• Monitor for suspicious activity related to the plugin's import functionality.

Technical summary

The Kirki plugin for WordPress is vulnerable to PHP Object Injection due to deserialization of untrusted input in versions up to 6.3.2. Authenticated attackers with administrator-level access can inject a PHP Object. However, the impact is limited without a POP chain present in another installed plugin or theme. The vulnerability exists because the plugin does not properly validate or sanitize input data, allowing attackers to inject malicious PHP objects. To exploit this vulnerability, an attacker would need to have administrator-level access or above and inject a malicious PHP object via the plugin's import endpoint. The exploitation of this vulnerability could potentially lead to arbitrary file deletion, or

Defensive priority

Assess exposure and verify POP chain presence in installed plugins and themes.

Recommended defensive actions

• Assess exposure by checking if the Kirki plugin version is within the vulnerable range and if any installed plugins or themes may provide a POP chain.
• Verify the presence of a POP chain in installed plugins and themes.
• Restrict access to the plugin's import endpoint to trusted users only.
• Monitor for suspicious activity related to the plugin's import functionality.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability exists in the Kirki plugin versions up to 6.3.2. The CVE record and NVD entry provide details on the vulnerability, but additional information from Wordfence security researchers is required for comprehensive understanding.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.