Kirki CVE-2026-12720

Exploitation requires three concurrent conditions: first, the target WordPress site must have the Kirki plugin installed and active in a version prior to 6.0.13; second, the site must have a co-installed plugin, theme, or outdated WordPress core version that supplies a usable PHP object injection gadget chain - no gadget chain means no impact beyond object injection itself; third, a WordPress administrator must access and review the stored Kirki data in the admin panel after the attacker has submitted the payload, satisfying the UI:R (required user interaction) condition in the CVSS vector. The CVSS PR:N metric confirms that no authentication is needed to write the malicious payload. Exploitation is limited by the gadget chain environmental dependency (AC:H), the non-default assumption that a vulnerable co-plugin exists, and the requirement for an authenticated admin user to trigger deserialization - defenders who restrict wp-admin access and maintain updated plugins significantly reduce realistic risk.

The CVSS 3.1 score of 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) correctly captures the dual-threshold nature of this vulnerability: high complexity (AC:H) reflects the mandatory gadget chain requirement, and required user interaction (UI:R) reflects the need for administrator review to trigger deserialization. These factors meaningfully depress real-world exploitability. The EPSS score of 0.22% at the 13th percentile reinforces this - despite a public POC existing, automated or mass exploitation is unlikely given the environmental dependency on gadget chain presence. SSVC rates exploitation as 'none' and automatable as 'no', consistent with EPSS, though this may lag behind the public POC disclosure. The SSVC technical impact of 'total' aligns with the C:H/I:H/A:H CVSS impact metrics, confirming that successful exploitation is severe. In practice, this is a real and serious risk for WordPress sites with Kirki installed alongside other plugins that supply exploitable gadget chains - particularly those running outdated WordPress core - but mass opportunistic exploitation is not the primary threat model here. The conflict between a public POC and SSVC's 'none' exploitation status warrants monitoring; this gap may close as exploit reliability improves.

An unauthenticated attacker crafts a malicious serialized PHP object payload and submits it through Kirki's data-storage endpoint, writing the payload to the WordPress database without any credential requirement. When a site administrator later navigates to the area of the WordPress admin panel that surfaces the stored Kirki data for review, WordPress deserializes the attacker's object, invoking PHP magic methods and triggering a gadget chain through classes loaded by a co-installed plugin or outdated WordPress core. If a complete chain to code execution exists, the attacker achieves arbitrary command execution as the web server user (typically www-data), potentially compromising the full WordPress installation and underlying server. A publicly available proof-of-concept exploit exists, lowering the skill threshold for this attack.