CVE-2026-12720 Overview
CVE-2026-12720 affects the Kirki WordPress plugin in versions before 6.0.13. The plugin deserialises attacker-controlled data without restricting which classes may be instantiated. Unauthenticated users can store crafted payloads that trigger PHP Object Injection when an administrator later reviews the stored data. This falls under Insecure Deserialization [CWE-502].
With a suitable gadget chain present on the site, from another vulnerable plugin or an outdated WordPress version, attackers can chain the flaw into remote code execution.
Critical Impact
Unauthenticated attackers can inject serialized PHP objects that execute when an administrator views the affected admin interface, potentially leading to remote code execution on the WordPress host.
Affected Products
- Kirki WordPress plugin versions prior to 6.0.13
- WordPress sites bundling Kirki as a theme customizer framework
- Any site where a compatible PHP gadget chain is available via other outdated plugins or WordPress core
Discovery Timeline
- 2026-07-31 - CVE-2026-12720 published to NVD
- 2026-07-31 - Last updated in NVD database
Technical Details for CVE-2026-12720
Vulnerability Analysis
The Kirki plugin deserialises user-supplied input using PHP's unserialize() function without an allow-list of permitted classes. When an unauthenticated visitor submits data that gets stored by the plugin, the serialized payload persists in the database. An administrator triggering the deserialisation later, by viewing the stored data in the admin dashboard, causes PHP to instantiate arbitrary classes present in the runtime.
Exploitation requires user interaction from an administrator and depends on the presence of a usable gadget chain elsewhere on the site. This raises attack complexity but does not require authentication from the attacker.
The EPSS score is 0.304% with a percentile of 22.744.
Root Cause
The root cause is unrestricted deserialization of untrusted input. The plugin calls PHP's native deserialization routines on attacker-controlled data without using the allowed_classes option introduced in PHP 7. Any class loaded in the WordPress runtime with a magic method such as __wakeup, __destruct, or __toString can be instantiated and executed.
Attack Vector
An unauthenticated remote attacker submits a crafted serialized PHP object to a Kirki endpoint that persists the payload. The payload remains dormant in the database until an administrator loads the admin page that unserializes stored data. Deserialization then instantiates the attacker-chosen object, invoking magic methods that trigger the gadget chain and lead to arbitrary code execution in the WordPress process context.
No verified public exploit code is available. See the WPScan Vulnerability Report for additional technical details.
Detection Methods for CVE-2026-12720
Indicators of Compromise
- Kirki plugin version prior to 6.0.13 reported by WordPress plugin inventory
- Unexpected PHP processes spawned by the web server user after administrator logins
- Serialized PHP data patterns such as O: or a: in POST bodies to Kirki endpoints
- Newly created administrator accounts or modified wp_options entries following admin dashboard access
Detection Strategies
- Inspect web server access logs for POST requests to Kirki endpoints containing serialized object markers
- Monitor WordPress database tables for stored values that begin with O: followed by a class name and length
- Alert on outbound network connections initiated by PHP-FPM or Apache workers immediately after admin authentication
Monitoring Recommendations
- Enable PHP error and access logging for the WordPress site to capture deserialization anomalies
- Track file integrity on wp-content/plugins/ and wp-content/themes/ for unexpected writes
- Correlate administrator login events with subsequent process creation on the underlying host
How to Mitigate CVE-2026-12720
Immediate Actions Required
- Update the Kirki plugin to version 6.0.13 or later on all WordPress installations
- Audit installed plugins and WordPress core for outdated components that could supply a gadget chain
- Review the database for stored serialized payloads submitted by unauthenticated users and remove suspicious entries
- Rotate WordPress administrator credentials and secret keys if compromise is suspected
Patch Information
Upgrade Kirki to version 6.0.13 or later. Refer to the WPScan Vulnerability Report for advisory details and fixed version references.
Workarounds
- Restrict access to Kirki-related endpoints via a web application firewall rule that blocks serialized PHP payloads in request bodies
- Temporarily deactivate the Kirki plugin until the patched version is deployed
- Limit administrator dashboard access to trusted IP ranges to reduce the window in which stored payloads deserialize
# Configuration example: update Kirki via WP-CLI
wp plugin update kirki --version=6.0.13
wp plugin list --name=kirki --fields=name,version,status
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
