The vulnerability is a PHP Object Injection flaw that occurs when the Kirki plugin deserializes untrusted input coming from a ZIP template import. Because the data is not validated, an attacker who can upload such a template can inject an arbitrary PHP object into the application context. The primary risk is that the injected object can trigger a Plain Object Payload (POP) chain if the site also has a plugin or theme that contains a suitable POP chain. Without a POP chain, the vulnerability does not allow code execution, but if one is present the attacker could delete files, read sensitive data, or execute code.

Affected installations are all sites running the WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin from themeum version 6.3.2 or older. The plugin is available as a WordPress plugin and is included by many theme builders. Users with Editor or higher roles have access to the import endpoint that accepts the ZIP file, so any user with those privileges can attempt exploitation.

The CVSS score is 7.2 and the EPSS score is not available, indicating a moderate severity but no data on how frequently the vulnerability is targeted. It is not listed in the CISA KEV catalog. Because the flaw is limited to authenticated users with Editor or higher privilege, the attack surface is restricted. Exploitation is only meaningful if a useful POP chain is also installed on the site. In short, the risk is significant for sites with vulnerable plugins or themes that provide a POP chain but lower for sites that do not have such code.