The Kirki plugin for WordPress contains a flaw that allows untrusted data to be deserialized. A crafted serialized payload can create arbitrary PHP objects that execute code during object construction or destruction. This vulnerability, identified as CWE-502, permits an attacker to run arbitrary PHP code on the host, potentially compromising data, messages, or the entire web application.

WordPress installations that run the Themeum Kirki plugin, version 6.0.12 or older, are affected. Sites that have not upgraded past the 6.0.12 release remain at risk.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in CISA KEV, but the ability to inject PHP objects means that a maliciously crafted payload sent through a plugin-enabled endpoint—an attack vector that is inferred from the deserialization behavior—could lead to remote code execution. The exact vector depends on how the plugin processes input, but it can be triggered by sending hostile data to any endpoint that passes user input to the deserialization function.