What is the CVSS score of CVE-2026-12720?

CVE-2026-12720 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Kirki are affected by CVE-2026-12720?

The Kirki WordPress plugin (versions before 6.0.13) contains a vulnerability that allows unauthenticated attackers to gain full control of affected WordPress servers, and publicly available exploit…. A patch is available.

Is there a public PoC exploit available for CVE-2026-12720?

Yes, a public proof-of-concept exploit is available for CVE-2026-12720. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-12720?

Within 24 hours: Identify all WordPress installations using Kirki plugin and document current versions. Within 7 days: Update all affected Kirki installations to version 6.0.13 or later and verify patches applied. Within 30 days: Audit server access logs for suspicious activity prior to patching, scan for evidence of exploitation or malware, and review administrator account activity during the vulnerable period.

Kirki CVE-2026-12720

EUVD-2026-51431 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-31 WPScan

GHSA-rpvq-6gf9-58vg

PHP WordPress RCE Deserialization Kirki Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

AV:N and PR:N because unauthenticated network submission stores payload; AC:H and UI:R because gadget chain presence and admin review are both mandatory prerequisites; C:H/I:H/A:H reflect full RCE capability if chain exists.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 18:31 vuln.today

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

HIGH 7.5

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via another installed Kirki WordPress plugin before 6.0.13, , or an outdated WordPress version), this could be leveraged to perform a variety of attacks, such as remote code execution.

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 2 Critical, 13 With POC Aug 01, 2026

AnalysisAI

PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users store malicious serialized PHP objects, which are then deserialized when an administrator reviews the stored data in the WordPress admin panel. With a suitable gadget chain present on the site - from another installed plugin or an outdated WordPress core - this can escalate to full remote code execution on the hosting server. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.22%, 13th percentile) and CISA has not listed this in KEV, suggesting no confirmed widespread in-the-wild exploitation at time of analysis.

Technical ContextAI

Kirki is a widely-used WordPress customizer framework (CPE: cpe:2.3:a:unknown:kirki:*:*:*:*:*:*:*:*) that extends the WordPress Theme Customization API, commonly embedded by theme and plugin authors. The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data): the plugin passes attacker-controlled input to PHP's native unserialize() function without first validating or allowlisting which classes may be instantiated. PHP object injection via unserialize() is a well-documented attack class - the deserialization process invokes PHP magic methods (__wakeup, __destruct, __toString) on the reconstructed object, which can be chained across classes present in the application's codebase to produce arbitrary side effects. The 'gadget chain' requirement means exploitability depends on the full set of PHP classes loaded by the WordPress environment, including other installed plugins or themes. Outdated WordPress core is explicitly called out as a potential source of exploitable gadgets.

RemediationAI

Update the Kirki WordPress plugin to version 6.0.13 or later, which introduces class allowlisting or equivalent controls on deserialization per vendor advisory (https://wpscan.com/vulnerability/22f5af1c-972e-4e31-9afa-bf50ac278c66/). Patch availability is confirmed by the vendor. If immediate patching is not feasible, the following compensating controls may reduce exposure: restrict access to the WordPress admin area (wp-admin) to trusted IP ranges via server-level firewall rules or the WordPress .htaccess, which limits the administrator review trigger required for exploitation; audit and remove unnecessary plugins that may supply exploitable PHP gadget chains, particularly any that are outdated or unmaintained; and ensure WordPress core is updated to the latest version to eliminate known gadget sources from core itself. Note that these controls reduce but do not eliminate risk - the unauthenticated data-storage step is still reachable from the network, and gadget chains may exist across many plugins. Patching Kirki to 6.0.13 is the only definitive fix.