CVE-2026-12720 INCIBE-CERT - Vulnerabilities RSS / 2d The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via another installed Kirki WordPress plugin before 6.0.13,, or an outdated WordPress version), this could be leveraged to perform a var

www.incibe.es • August 2, 2026

Vector de acceso (AV): A través de red Complejidad de acceso (AC): Alto Privilegios Requeridos (PR): Ninguno Interacción del usuario (UI): Obligatorio Alcance (S): Sin modificar Impacto a la confidencialidad (C): Alto Impacto a la integridad (I): Alto Impacto a la disponibilidad (A): Alto

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerability in Kirki WordPress Plugin Exposes Sites to Remote Code Execution The Kirki WordPress plugin prior to version 6.0.13 has a critical vulnerability (CVE-2026-12720) that allows unauthenticated users to store malicious serialized objects. This leads to PHP Object Injection when an administrator reviews the stored data, potentially enabling remote code execution if a suitable gadget chain exists. The vulnerability affects any WordPress site using the outdated Kirki plugin or older WordPress versions. Currently, there are no known public proof-of-concept exploits or confirmed instances of exploitation. Administrators are advised to update to version 6.0.13 or later and restrict access to trusted users. The CVSS score for this vulnerability is 7.5, indicating a high severity level. The vulnerability was officially published on July 31, 2026. 3 sources 68

Extracted Entities

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (3)