Critical Vulnerability in Kirki WordPress Plugin Exposes Sites to Remote Code Execution

Feedly

Critical Vulnerability in Kirki WordPress Plugin Exposes Sites to Remote Code Execution

First seen 2 Aug 2026, 08:52 UTC • •67.5

Article Content

1 / 6

Browse articles

ThreatCluster •August 3, 2026 at 06:03 UTC

•CVE-2026-12720 affects Kirki WordPress plugin versions before 6.0.13.
•The vulnerability allows PHP Object Injection, leading to potential remote code execution.
•No confirmed exploits have been reported, but immediate updates are recommended.

The Kirki WordPress plugin prior to version 6.0.13 has a critical vulnerability (CVE-2026-12720) that allows unauthenticated users to store malicious serialized objects. This leads to PHP Object Injection when an administrator reviews the stored data, potentially enabling remote code execution if a suitable gadget chain exists. The vulnerability affects any WordPress site using the outdated Kirki plugin or older WordPress versions. Currently, there are no known public proof-of-concept exploits or confirmed instances of exploitation. Administrators are advised to update to version 6.0.13 or later and restrict access to trusted users. The CVSS score for this vulnerability is 7.5, indicating a high severity level. The vulnerability was officially published on July 31, 2026.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 50d ago How this analysis works

Timeline

2026-07-31

CVE-2026-12720 published

The vulnerability in Kirki WordPress plugin was officially published, detailing the PHP Object Injection risk.

2026-08-02

Multiple advisories released

Advisories from Feedly, NVD, and INCIBE-CERT highlight the critical nature of CVE-2026-12720.

2026-08-02

Recommendations issued for plugin update

Security experts recommend updating the Kirki plugin to version 6.0.13 or later to mitigate risks.

More articles in this cluster (5)

Threat Graph

8 entities, 13 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Zero-day Exploit
T1190 - Exploit Public-Facing Application
T1203 - Exploitation for Client Execution

Vulnerability (1)

CVE-2026-12720

Weakness (1)

Cwe-502 - Deserialization Of Untrusted Data

Affected Platform (3)

Kirki
PHP
WordPress

Relationships

CVE-2026-12720 targets Kirki
CVE-2026-12720 targets PHP
CVE-2026-12720 targets WordPress
Zero-day Exploit targets Kirki
Zero-day Exploit targets PHP
Zero-day Exploit targets WordPress
T1190 - Exploit Public-Facing Application targets Kirki
T1190 - Exploit Public-Facing Application targets PHP
T1190 - Exploit Public-Facing Application targets WordPress
T1203 - Exploitation for Client Execution targets Kirki
T1203 - Exploitation for Client Execution targets PHP
T1203 - Exploitation for Client Execution targets WordPress
CVE-2026-12720 related to Cwe-502 - Deserialization Of Untrusted Data

Following this threat?

Track CVE-2026-12720 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical WSO2 API Manager Vulnerability Under Active Exploitation A critical vulnerability (CVE-2026-5430) in WSO2 API Manager is being actively exploited, allowing unauthenticated attackers to forge admin tokens via JWT authentication bypass. This flaw, which has a CVSS score of 10.0, affects multiple WSO2 products including API Manager, Universal Gateway, Traffic Manager, and API…

Critical Linux Kernel Vulnerability CVE-2025-39682 Under Active Exploitation A critical vulnerability (CVE-2025-39682) in the Linux kernel allows remote code execution through mishandling of zero-length TLS records. This flaw affects kTLS-enabled hosts running vulnerable kernel versions, exposing them to attackers without authentication. CISA added this vulnerability to its Known Exploited…