CVE-2026-57724

CriticalCVSS 9.8

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

43th percentile - higher than 43% of all known CVEs

Summary

The Kirki WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. This affects versions up to and including 6.0.12.

Risk Assessment

An attacker can remotely execute arbitrary code or take control of the WordPress site by injecting a crafted object during data deserialization.

Recommendation

Immediately update the Kirki plugin to the latest available version that fixes this vulnerability.

Original NVD description (English source)

Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12.