Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 - Unauthenticated PHP Object Injection

This research plan focuses on identifying and exploiting the Unauthenticated PHP Object Injection vulnerability in the Kirki – Freeform Page Builder plugin (CVE-2026-57724).

1. Vulnerability Summary

The vulnerability exists in versions of the Kirki plugin up to and including 6.0.12. It is a PHP Object Injection vulnerability caused by the insecure use of unserialize() (or its wrapper maybe_unserialize()) on untrusted input. Because the input can be supplied by an unauthenticated user, an attacker can inject arbitrary PHP objects. If a suitable POP (Property Oriented Programming) chain exists in the WordPress environment (via other plugins or the theme), this can lead to remote code execution, file deletion, or sensitive data retrieval.

2. Attack Vector Analysis

• Endpoint: Likely an AJAX action via admin-ajax.php or a REST API endpoint registered in includes/API.php via FrontendApi::register().
• Vulnerable Action: Based on the provided JS files, kirki_post_apis is a primary suspect. However, an "unauthenticated" vulnerability typically involves an action registered with the wp_ajax_nopriv_ prefix or a REST route with a permission_callback that returns true.
• Payload Parameter: Common parameters in Kirki for such data include kirki_data, data, settings, or config.
• Authentication: None required (Unauthenticated).
• Complexity: High (requires a POP chain not present in Kirki itself).

3. Code Flow

1. Entry Point: An unauthenticated request is sent to admin-ajax.php?action=kirki_... or a REST route like /wp-json/kirki/v1/....
2. Hook: The action is handled by a method in a class like Kirki\API\PostApis or Kirki\API\Frontend\FrontendApi.
3. Input Source: The code retrieves a parameter from $_POST or $_GET.
4. The Sink: The code calls unserialize() or maybe_unserialize() on this input without prior validation or signature checking.
5. Injection: The PHP engine instantiates the injected object, triggering magic methods (__wakeup, __destruct, __toString).

4. Nonce Acquisition Strategy

While the vulnerability is labeled "Unauthenticated," some handlers may still attempt a nonce check that is bypassable or improperly implemented for logged-out users.

• Suspected Nonce Variable: window.kirki_admin?.nonce (found in assets/js/admin/custom-link-in-toolbar.js).
• Acquisition Method:
  1. The kirki_admin object is likely localized on post editing pages or pages where the Kirki editor is active.
  2. Check if any public-facing page (e.g., a page containing a Kirki block or shortcode) enqueues the script and localizes the nonce.
  3. Action: Use browser_navigate to the homepage or a Kirki-built page.
  4. Extraction: browser_eval("window.kirki_admin?.nonce").
• Bypass Check: Verify if the backend handler for the nopriv action actually calls check_ajax_referer or wp_verify_nonce. If the action is truly unauthenticated, it may omit this check entirely.

5. Exploitation Strategy

Since Kirki lacks a built-in POP chain, the PoC will focus on demonstrating the injection.

1. Locate Sink:
   • Search the plugin directory for unserialize or maybe_unserialize.
   • grep -rP "unserialize\s*\(\s*\\$(?:_GET|_POST|_REQUEST|data|config|settings)" .
2. Identify Endpoint:
   • Trace the sink back to an add_action('wp_ajax_nopriv_...', ...) or register_rest_route.
3. Prepare Payload:
   • Construct a dummy object to prove injection (e.g., O:8:"stdClass":1:{s:3:"poc";s:7:"success";}).
   • Base64 encode the payload if the code expects it: Tzo4OiJzdGRDbGFzcyI6MTp7czozOiJwb2MiO3M6Nzoic3VjY2VzcyI7fQ==.
4. Send Request:

   # Example AJAX request
   http_request POST "http://localhost:8080/wp-admin/admin-ajax.php" \
     --data "action=kirki_vulnerable_action&data=PAYLOAD_HERE" \
     --header "Content-Type: application