{
 "id": "WPSEC-2026-0899",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0899/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0899/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0899/index.md",
 "title": "Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.2 - Authenticated (Editor+) PHP Object Injection via Template Import",
 "description": "The Kirki plugin for WordPress is vulnerable to PHP Object Injection via the template import feature in all versions up to, and including, 6.3.2 due to deserialization of untrusted post meta values taken from the JSON inside an uploaded template ZIP using maybe_unserialize(). This makes it possible for authenticated attackers with editor-level access or higher who can import templates to inject a PHP object. No known POP chain is present in the plugin itself; if a POP chain is present via another plugin or theme installed on the target site, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",
 "plugin": {
  "slug": "kirki",
  "name": "Kirki – Freeform Page Builder, Website Builder & Customizer",
  "full_name": "Kirki – Freeform Page Builder, Website Builder & Customizer",
  "wordpress_org": "https://wordpress.org/plugins/kirki/",
  "advisories_url": "https://wpsec.com/vuln/plugin/kirki/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/kirki"
 },
 "type": "OBJECT INJECTION",
 "cwe": [
  "CWE-502"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.6,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "6.0.0",
    "from_inclusive": true,
    "to": "6.4.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 6.0.0 before 6.4.0"
  ]
 },
 "introduced_in": "6.0.0",
 "fixed_in": "6.4.0",
 "remediation": "Update to 6.4.0 or later.",
 "fix_released": "2026-10-13T12:30:44+00:00",
 "published": "2026-10-14T12:52:26+00:00",
 "updated": "2026-10-14T12:18:22.499661+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0899/",
  "https://plugins.svn.wordpress.org/kirki/tags/6.4.0/",
  "https://wordpress.org/plugins/kirki/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/kirki",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-14"
 }
}