EUVD-2026-51431
GHSA-rpvq-6gf9-58vg
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:N and PR:N because unauthenticated network submission stores payload; AC:H and UI:R because gadget chain presence and admin review are both mandatory prerequisites; C:H/I:H/A:H reflect full RCE capability if chain exists.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via another installed Kirki WordPress plugin before 6.0.13, , or an outdated WordPress version), this could be leveraged to perform a variety of attacks, such as remote code execution.
Articles & Coverage 1
AnalysisAI
PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users store malicious serialized PHP objects, which are then deserialized when an administrator reviews the stored data in the WordPress admin panel. With a suitable gadget chain present on the site - from another installed plugin or an outdated WordPress core - this can escalate to full remote code execution on the hosting server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: first, the target WordPress site must have the Kirki plugin installed and active in a version prior to 6.0.13; second, the site must have a co-installed plugin, theme, or outdated WordPress core version that supplies a usable PHP object injection gadget chain - no gadget chain means no impact beyond object injection itself; third, a WordPress administrator must access and review the stored Kirki data in the admin panel after the attacker has submitted the payload, satisfying the UI:R (required user interaction) condition in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) correctly captures the dual-threshold nature of this vulnerability: high complexity (AC:H) reflects the mandatory gadget chain requirement, and required user interaction (UI:R) reflects the need for administrator review to trigger deserialization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker crafts a malicious serialized PHP object payload and submits it through Kirki's data-storage endpoint, writing the payload to the WordPress database without any credential requirement. When a site administrator later navigates to the area of the WordPress admin panel that surfaces the stored Kirki data for review, WordPress deserializes the attacker's object, invoking PHP magic methods and triggering a gadget chain through classes loaded by a co-installed plugin or outdated WordPress core. … |
| Remediation | Update the Kirki WordPress plugin to version 6.0.13 or later, which introduces class allowlisting or equivalent controls on deserialization per vendor advisory (https://wpscan.com/vulnerability/22f5af1c-972e-4e31-9afa-bf50ac278c66/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all WordPress installations using Kirki plugin and document current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today