[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6bwhxL-oyBWtP9Lpr4uHEx1JDdUEXvOf4qEA324rnzU":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57724","kirki-freeform-page-builder-website-builder-customizer-unauthenticated-php-object-injection","Kirki – Freeform Page Builder, Website Builder & Customizer \u003C= 6.0.12 - Unauthenticated PHP Object Injection","The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.0.12 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.","kirki",null,"\u003C=6.0.12","6.0.13","high",8.1,"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H","Deserialization of Untrusted Data","2026-07-06 00:00:00","2026-07-14 19:56:44",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F2b8db99d-95ec-41e6-bdb4-9db598ed80e1?source=api-prod",9,[22,23,24,25,26,27,28,29],"assets\u002Fcss\u002Fkirki-editor.min.css","assets\u002Fcss\u002Fkirki-iframe.min.css","assets\u002Fjs\u002Fadmin\u002Fcustom-link-in-toolbar.js","assets\u002Fjs\u002Fkirki-editor.min.js","assets\u002Fjs\u002Fkirki.min.js","config.php","customizer\u002Fpackages\u002Futils\u002Fsrc\u002FUtil.php","includes\u002FAPI.php","researched",false,3,"This research plan focuses on identifying and exploiting the **Unauthenticated PHP Object Injection** vulnerability in the **Kirki – Freeform Page Builder** plugin (CVE-2026-57724).\n\n### 1. Vulnerability Summary\nThe vulnerability exists in versions of the Kirki plugin up to and including **6.0.12**. It is a **PHP Object Injection** vulnerability caused by the insecure use of `unserialize()` (or its wrapper `maybe_unserialize()`) on untrusted input. Because the input can be supplied by an unauthenticated user, an attacker can inject arbitrary PHP objects. If a suitable POP (Property Oriented Programming) chain exists in the WordPress environment (via other plugins or the theme), this can lead to remote code execution, file deletion, or sensitive data retrieval.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** Likely an AJAX action via `admin-ajax.php` or a REST API endpoint registered in `includes\u002FAPI.php` via `FrontendApi::register()`.\n*   **Vulnerable Action:** Based on the provided JS files, `kirki_post_apis` is a primary suspect. However, an \"unauthenticated\" vulnerability typically involves an action registered with the `wp_ajax_nopriv_` prefix or a REST route with a `permission_callback` that returns `true`.\n*   **Payload Parameter:** Common parameters in Kirki for such data include `kirki_data`, `data`, `settings`, or `config`.\n*   **Authentication:** None required (Unauthenticated).\n*   **Complexity:** High (requires a POP chain not present in Kirki itself).\n\n### 3. Code Flow\n1.  **Entry Point:** An unauthenticated request is sent to `admin-ajax.php?action=kirki_...` or a REST route like `\u002Fwp-json\u002Fkirki\u002Fv1\u002F...`.\n2.  **Hook:** The action is handled by a method in a class like `Kirki\\API\\PostApis` or `Kirki\\API\\Frontend\\FrontendApi`.\n3.  **Input Source:** The code retrieves a parameter from `$_POST` or `$_GET`.\n4.  **The Sink:** The code calls `unserialize()` or `maybe_unserialize()` on this input without prior validation or signature checking.\n5.  **Injection:** The PHP engine instantiates the injected object, triggering magic methods (`__wakeup`, `__destruct`, `__toString`).\n\n### 4. Nonce Acquisition Strategy\nWhile the vulnerability is labeled \"Unauthenticated,\" some handlers may still attempt a nonce check that is bypassable or improperly implemented for logged-out users.\n\n*   **Suspected Nonce Variable:** `window.kirki_admin?.nonce` (found in `assets\u002Fjs\u002Fadmin\u002Fcustom-link-in-toolbar.js`).\n*   **Acquisition Method:**\n    1.  The `kirki_admin` object is likely localized on post editing pages or pages where the Kirki editor is active.\n    2.  Check if any public-facing page (e.g., a page containing a Kirki block or shortcode) enqueues the script and localizes the nonce.\n    3.  **Action:** Use `browser_navigate` to the homepage or a Kirki-built page.\n    4.  **Extraction:** `browser_eval(\"window.kirki_admin?.nonce\")`.\n*   **Bypass Check:** Verify if the backend handler for the `nopriv` action actually calls `check_ajax_referer` or `wp_verify_nonce`. If the action is truly unauthenticated, it may omit this check entirely.\n\n### 5. Exploitation Strategy\nSince Kirki lacks a built-in POP chain, the PoC will focus on demonstrating the injection.\n\n1.  **Locate Sink:**\n    *   Search the plugin directory for `unserialize` or `maybe_unserialize`.\n    *   `grep -rP \"unserialize\\s*\\(\\s*\\\\$(?:_GET|_POST|_REQUEST|data|config|settings)\" .`\n2.  **Identify Endpoint:**\n    *   Trace the sink back to an `add_action('wp_ajax_nopriv_...', ...)` or `register_rest_route`.\n3.  **Prepare Payload:**\n    *   Construct a dummy object to prove injection (e.g., `O:8:\"stdClass\":1:{s:3:\"poc\";s:7:\"success\";}`).\n    *   Base64 encode the payload if the code expects it: `Tzo4OiJzdGRDbGFzcyI6MTp7czozOiJwb2MiO3M6Nzoic3VjY2VzcyI7fQ==`.\n4.  **Send Request:**\n    ```bash\n    # Example AJAX request\n    http_request POST \"http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php\" \\\n      --data \"action=kirki_vulnerable_action&data=PAYLOAD_HERE\" \\\n      --header \"Content-Type: application","The Kirki plugin for WordPress is vulnerable to Unauthenticated PHP Object Injection in versions up to 6.0.12 due to the insecure use of deserialization functions on untrusted user input. By sending a crafted POST request to an unauthenticated API endpoint, an attacker can inject arbitrary PHP objects, potentially leading to remote code execution or file manipulation if a suitable POP chain exists in the environment.","\u002F\u002F includes\u002FAPI.php line 47-53\n\tpublic function register_api() {\n\t\t\u002F\u002F Media apis.\n\t\t$media = new Media();\n\t\t$media->register_routes();\n\n\t\t$content_manager = new ContentManagerRest();\n\t\t$content_manager->register_routes();\n\n\t\t$kirki_comments = new KirkiCommentsRest();\n\t\t$kirki_comments->register_routes();\n\n\t\tFrontendApi::register();\n\t}\n\n---\n\n\u002F\u002F The vulnerability occurs in the handlers registered by FrontendApi::register() or similar AJAX actions.\n\u002F\u002F These handlers process user-supplied parameters (such as 'data' or 'settings') using maybe_unserialize() without validation.\n\u002F\u002F Example of the vulnerable pattern suspected in the underlying handlers:\n\u002F\u002F $settings = maybe_unserialize( $_POST['data'] );","Only in \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fkirki\u002F6.0.13: app\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fkirki\u002F6.0.12\u002Fassets\u002Fcss\u002Fkirki-editor.min.css \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fkirki\u002F6.0.13\u002Fassets\u002Fcss\u002Fkirki-editor.min.css\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fkirki\u002F6.0.12\u002Fassets\u002Fcss\u002Fkirki-editor.min.css\t2026-06-24 12:03:12.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fkirki\u002F6.0.13\u002Fassets\u002Fcss\u002Fkirki-editor.min.css\t2026-07-03 11:43:06.000000000 +0000\n@@ -1 +1 @@\n-@font-face{font-display:swap;font-family:Inter;font-style:normal;font-weight:400;src:url(..\u002F..\u002Ffonts\u002FInter-Regular.woff) format(\"woff\")}@font-face{font-display:swap;font-family:Inter;font-style:normal;font-weight:700;src:url(..\u002F..\u002Ffonts\u002FInter-Bold.woff) format(\"woff\")}... (truncated)","1. Identify the target WordPress installation running Kirki version 6.0.12 or earlier.\n2. Locate an unauthenticated endpoint registered by the plugin, such as a REST API route under '\u002Fwp-json\u002Fkirki\u002Fv1\u002F' or an AJAX action like 'kirki_post_apis' that processes serialized input.\n3. Identify a suitable PHP Object Injection (POP) chain present in the WordPress environment (e.g., from other plugins or the active theme).\n4. Prepare a payload containing the serialized POP chain object, potentially Base64 encoding it if required by the specific handler.\n5. Send a POST request to the identified endpoint with the payload in the expected parameter (e.g., 'data', 'settings', or 'config').\n6. The server's call to maybe_unserialize() on the malicious input will instantiate the object and trigger its magic methods (e.g., __wakeup, __destruct), leading to the execution of the POP chain.","gemini-3-flash-preview","2026-07-25 09:17:16","2026-07-25 09:18:40",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","6.0.12","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fkirki\u002Ftags\u002F6.0.12","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fkirki.6.0.12.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fkirki\u002Ftags\u002F6.0.13","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fkirki.6.0.13.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fkirki\u002Ftags"]