CVE-2026-12720

CVE

Threat entity extracted from intelligence sources

Frequency

3

occurrences

First Seen

August 2, 2026

Last Seen

August 2, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical Vulnerability in Kirki WordPress Plugin Exposes Sites to Remote Code Execution67.5

The Kirki WordPress plugin prior to version 6.0.13 has a critical vulnerability (CVE-2026-12720) that allows unauthenticated users to store malicious serialized objects. This leads to PHP Object Injection when an administrator reviews the stored data, potentially enabling remote code execution if a...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

Critical Vulnerability in Kirki WordPress Plugin Exposes Sites to Remote Code Execution

Aug 2·3 sources

Related Articles (3)

CVE-2026-12720 National Vulnerability Database / 2d The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via another installed Kirki WordPress plugin before 6.0.13, , or an outdated WordPress version), this could be leveraged to perform a vari

nvd.nist.gov·Aug 2

CVE-2026-12720 INCIBE-CERT - Vulnerabilities RSS / 2d The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via another installed Kirki WordPress plugin before 6.0.13,, or an outdated WordPress version), this could be leveraged to perform a var

www.incibe.es·Aug 2

CVE-2026-12720 - Exploits & Severity

Related Entities

Zero-day Exploit Cwe-502 - Deserialization Of Untrusted Data T1190 - Exploit Public-Facing Application T1203 - Exploitation for Client Execution WordPress Kirki PHP