Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.2 - Authenticated (Editor+) PHP Object Injection via Template Import

ID

WPSEC-2026-0899

Plugin

Kirki – Freeform Page Builder, Website Builder & Customizer (kirki)

Affected

from 6.0.0 before 6.4.0

Remediation

Update to 6.4.0 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness

CWE-502

Usage

Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-14

Attack surface

Kirki – Freeform Page Builder, Website Builder & Customizer on WPSec AttackSurface

Fix released

2026-10-13

Published

2026-10-14

Description

The Kirki plugin for WordPress is vulnerable to PHP Object Injection via the template import feature in all versions up to, and including, 6.3.2 due to deserialization of untrusted post meta values taken from the JSON inside an uploaded template ZIP using maybe_unserialize(). This makes it possible for authenticated attackers with editor-level access or higher who can import templates to inject a PHP object. No known POP chain is present in the plugin itself; if a POP chain is present via another plugin or theme installed on the target site, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

References

• https://wpsec.com/vuln/WPSEC-2026-0899/
• https://plugins.svn.wordpress.org/kirki/tags/6.4.0/
• https://wordpress.org/plugins/kirki/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS