CVE-2026-104734: CWE-502 Deserialization of Untrusted Data in themeum Kirki – Freeform Page Builder, Website Builder & Customizer

CVE-2026-104734 describes a PHP Object Injection vulnerability in the Kirki WordPress plugin (versions up to 6.3.2) caused by unsafe deserialization of untrusted input. Authenticated users with Editor or higher privileges can inject PHP objects. However, no gadget chain (POP chain) is present within Kirki itself, so exploitation depends on the presence of a vulnerable plugin or theme that provides a POP chain. If such a chain exists, attackers could perform high-impact actions including arbitrary file deletion, sensitive data access, or remote code execution. The default plugin configuration grants Editor-level users full access to the vulnerable import endpoint, broadening the scope of potential attackers.

The vulnerability allows high-impact actions such as arbitrary file deletion, sensitive data disclosure, or remote code execution but only if a POP chain is present in another installed plugin or theme. Without a POP chain, the vulnerability cannot be exploited to cause harm. The risk is elevated because Editor-level users (not just administrators) have full access to the vulnerable functionality by default.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Kirki plugin's import endpoint to trusted users only and consider removing or disabling other plugins or themes that may contain POP chains. Review and adjust the KIRKI_USERS_DEFAULT_FULL_ACCESS configuration to limit access to administrators only if possible.