# Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.2 - Authenticated (Editor+) PHP Object Injection via Template Import

- **ID:** WPSEC-2026-0899
- **Plugin:** Kirki – Freeform Page Builder, Website Builder & Customizer (`kirki`), https://wordpress.org/plugins/kirki/
- **Affected versions:** from 6.0.0 before 6.4.0
- **Fixed in:** 6.4.0 (Update to 6.4.0 or later.)
- **Severity:** Medium 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-502
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/kirki
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0899/

## Description

The Kirki plugin for WordPress is vulnerable to PHP Object Injection via the template import feature in all versions up to, and including, 6.3.2 due to deserialization of untrusted post meta values taken from the JSON inside an uploaded template ZIP using maybe_unserialize(). This makes it possible for authenticated attackers with editor-level access or higher who can import templates to inject a PHP object. No known POP chain is present in the plugin itself; if a POP chain is present via another plugin or theme installed on the target site, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

## References

- https://wpsec.com/vuln/WPSEC-2026-0899/
- https://plugins.svn.wordpress.org/kirki/tags/6.4.0/
- https://wordpress.org/plugins/kirki/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0899/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.