Threats tagged 'ghsa-rpvq-6gf9-58vg'

CVE-2026-12720 is a deserialization vulnerability in the Kirki WordPress plugin before version 6.0.13. It allows unauthenticated users to store serialized data without restrictions on which classes may be instantiated. When an administrator later reviews this data, it can trigger PHP Object Injection. If a suitable gadget chain exists on the site, this vulnerability could lead to remote code execution or other attacks.