The Kirki WordPress plugin versions prior to 6.0.13 do not restrict class instantiation during deserialization of data that unauthenticated users can store. This leads to PHP Object Injection vulnerabilities triggered upon administrator review of the stored data. Exploitation requires a suitable gadget chain present on the site, which may come from another Kirki plugin version or an outdated WordPress installation. The vulnerability is identified as CWE-502 and has a CVSS 3.1 score of 7.5, indicating high severity. No official patch or remediation level is currently documented.

Successful exploitation can lead to high-impact consequences including remote code execution, complete compromise of confidentiality, integrity, and availability of the affected system. The attack vector is remote with high attack complexity and no privileges required, but user interaction (administrator reviewing data) is necessary.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's data storage and review functionality to trusted administrators only. Monitor for updates from the Kirki plugin maintainers and apply any official patches promptly.