CVE-2026-104734 | CVSS: 7.2 | 严重级别: HIGH
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system
参考链接:
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.2/includes/Ajax.php#L8
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.2/includes/Ajax/Templa
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.2/includes/ExportImpor
📌 数据来源: NVD 官方