{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/kirki--freeform-page-builder-website-builder--customizer--6.3.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kirki:kirki:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-104734"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kirki – Freeform Page Builder, Website Builder \u0026 Customizer (\u003c= 6.3.2)"],"_cs_severities":["high"],"_cs_tags":["wordpress","vulnerability","php-injection","web-application"],"_cs_type":"advisory","_cs_vendors":["Kirki"],"content_html":"\u003cp\u003eThe Kirki - Freeform Page Builder, Website Builder \u0026amp; Customizer plugin for WordPress is susceptible to a PHP Object Injection vulnerability (CVE-2026-104734) affecting all versions up to and including 6.3.2. The vulnerability originates from the insecure deserialization of untrusted input handled by the plugin.\u003c/p\u003e\n\u003cp\u003eAlthough the Kirki plugin does not natively include a Property-Oriented Programming (POP) chain, the existence of such chains within other installed plugins or themes on the same WordPress environment renders this vulnerability exploitable. Successfully leveraging this flaw can lead to severe impacts, including arbitrary file deletion, unauthorized sensitive data retrieval, or remote code execution, depending on the gadgets present in the broader ecosystem of the target site. Notably, due to the default configuration KIRKI_USERS_DEFAULT_FULL_ACCESS, Editor-level users possess the necessary permissions to interact with the vulnerable import endpoint, expanding the potential attacker pool beyond just administrators.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the WordPress instance using valid credentials with at least Editor-level privileges.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to the administrative interface where the Kirki plugin import functionality is exposed.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious serialized PHP object payload designed to interface with existing POP chains in other installed plugins or themes.\u003c/li\u003e\n\u003cli\u003eAttacker submits the serialized object to the vulnerable Kirki import endpoint via a standard HTTP POST request.\u003c/li\u003e\n\u003cli\u003eThe Kirki plugin deserializes the attacker-controlled input without sufficient validation.\u003c/li\u003e\n\u003cli\u003eThe PHP runtime instantiates the injected object, triggering the secondary POP chain within the target environment.\u003c/li\u003e\n\u003cli\u003eThe target system executes the unintended operations associated with the POP chain, such as filesystem modification or code execution.\u003c/li\u003e\n\u003cli\u003eAttacker achieves the final objective, which may include data exfiltration, system persistence, or full remote control of the server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability carries a CVSS v3.1 base score of 7.2, reflecting the potential for significant compromise in WordPress environments where vulnerable themes or plugins coexist with Kirki. If a functional POP chain is available, attackers can perform malicious actions ranging from the deletion of critical system files to the execution of arbitrary code, effectively granting them control over the affected WordPress installation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade the Kirki plugin to the latest version beyond 6.3.2 to mitigate the underlying deserialization flaw.\u003c/li\u003e\n\u003cli\u003eAudit all installed WordPress plugins and themes for known POP chain gadgets to reduce the attack surface.\u003c/li\u003e\n\u003cli\u003eAudit user roles and permissions to ensure that Editor-level access is strictly necessary, specifically reviewing the KIRKI_USERS_DEFAULT_FULL_ACCESS configuration.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for HTTP POST requests directed toward the plugin's import endpoints that contain serialized PHP structures or common gadget strings.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-17T04:47:57Z","date_published":"2026-10-17T04:47:57Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-104734-kirki/","summary":"The Kirki WordPress plugin is vulnerable to PHP Object Injection in versions 6.3.2 and earlier, allowing authenticated users with Editor or Administrator access to trigger deserialization of untrusted input.","title":"PHP Object Injection in Kirki WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-104734-kirki/"}],"language":"en","title":"CraftedSignal Threat Feed - Kirki – Freeform Page Builder, Website Builder \u0026 Customizer (\u003c= 6.3.2)","version":"https://jsonfeed.org/version/1.1"}