Although the Kirki plugin does not natively include a Property-Oriented Programming (POP) chain, the existence of such chains within other installed plugins or themes on the same WordPress environment renders this vulnerability exploitable. Successfully leveraging this flaw can lead to severe impacts, including arbitrary file deletion, unauthorized sensitive data retrieval, or remote code execution, depending on the gadgets present in the broader ecosystem of the target site. Notably, due to the default configuration KIRKI_USERS_DEFAULT_FULL_ACCESS, Editor-level users possess the necessary permissions to interact with the vulnerable import endpoint, expanding the potential attacker pool beyond just administrators.

Attack Chain

1. Attacker authenticates to the WordPress instance using valid credentials with at least Editor-level privileges.
2. Attacker navigates to the administrative interface where the Kirki plugin import functionality is exposed.
3. Attacker crafts a malicious serialized PHP object payload designed to interface with existing POP chains in other installed plugins or themes.
4. Attacker submits the serialized object to the vulnerable Kirki import endpoint via a standard HTTP POST request.
5. The Kirki plugin deserializes the attacker-controlled input without sufficient validation.
6. The PHP runtime instantiates the injected object, triggering the secondary POP chain within the target environment.
7. The target system executes the unintended operations associated with the POP chain, such as filesystem modification or code execution.
8. Attacker achieves the final objective, which may include data exfiltration, system persistence, or full remote control of the server.

Impact

The vulnerability carries a CVSS v3.1 base score of 7.2, reflecting the potential for significant compromise in WordPress environments where vulnerable themes or plugins coexist with Kirki. If a functional POP chain is available, attackers can perform malicious actions ranging from the deletion of critical system files to the execution of arbitrary code, effectively granting them control over the affected WordPress installation.

Recommendation

• Immediately upgrade the Kirki plugin to the latest version beyond 6.3.2 to mitigate the underlying deserialization flaw.
• Audit all installed WordPress plugins and themes for known POP chain gadgets to reduce the attack surface.
• Audit user roles and permissions to ensure that Editor-level access is strictly necessary, specifically reviewing the KIRKI_USERS_DEFAULT_FULL_ACCESS configuration.
• Monitor web server logs for HTTP POST requests directed toward the plugin's import endpoints that contain serialized PHP structures or common gadget strings.