The Kirki WordPress plugin version 6.0.13 or earlier fails to restrict the classes that can be instantiated when deserialising data that unauthenticated users can store. This flaw leads to PHP Object Injection, allowing an attacker to inject a malicious serialized object that will be unserialised later when a site administrator reviews the data. The injection, when combined with a gadget chain supplied by another vulnerable plugin or an outdated WordPress core, can be exploited to execute arbitrary code or otherwise compromise the site. The weakness is captured by CWE‑502, which denotes insecure deserialisation of untrusted data.

Any WordPress installation that utilizes the Kirki plugin with a version below 6.0.13 is affected. The vulnerability is specific to the Kirki plugin itself; no other vendors or products are referenced. Systems that have multiple installations of Kirki prior to 6.0.13 or that have other plugins providing compatible gadget classes are at higher risk.

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score of 0.00304, or roughly 0.3 %, suggests that exploitation is improbable but still realistic given the potential impact. Because the flaw can be triggered by unauthenticated users storing data that later becomes deserialised by a privileged administrator, the attack is feasible when an attacker can direct the administrator to review malicious content. The vulnerability is not listed in the CISA KEV catalog, but the possibility of remote code execution via gadget chains warrants close monitoring and timely remediation.