CVE-2026-104734

Executive Summary

CVE-2026-104734 is a PHP Object Injection vulnerability (CWE-502) in the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress, affecting all versions up to and including 6.3.2. The flaw stems from deserialization of untrusted input at the plugin's import endpoint; because the KIRKI_USERS_DEFAULT_FULL_ACCESS configuration grants Editor-level users full access to that endpoint by default, exploitation requires only Editor privileges rather than full administrator rights. Impact is conditional: the plugin itself contains no known POP chain, so the vulnerability has no direct standalone impact — but when another installed plugin or theme supplies a usable POP/gadget chain, a successful attacker can chain to delete arbitrary files, retrieve sensitive data, or achieve code execution.

Technical Analysis

The vulnerability is a classic PHP Object Injection primitive arising from insecure deserialization of untrusted input (CWE-502), exposed through the plugin's import endpoint. WordPress plugins that support importing configuration or customization data frequently accept serialized PHP data (serialize()/unserialize() format) to move structured settings between installations. When that imported data is passed to PHP deserialization routines without adequate type allow-listing or integrity validation, an attacker controlling the request body can submit an arbitrary serialized payload.

Two elements define the attack surface here:

1. Source of taint — the import endpoint. The plugin exposes an import functionality reachable over the network (AV:N). The exact request parameter or file field that carries the serialized blob is not disclosed in the NVD description, so it must be enumerated during testing rather than assumed. What is confirmed is that untrusted input reaching this endpoint is deserialized.

2. Access control gap — KIRKI_USERS_DEFAULT_FULL_ACCESS. By default, Editor-level users are granted FULL_ACCESS to the import endpoint via this configuration constant. This is the most operationally important detail of the CVE: although the CVSS vector carries PR:H (High privileges required), the practical bar is Editor, a role frequently held by content teams, contractors, and multi-tenant site operators. This widens the realistic attacker pool well beyond site administrators.

The standalone impact is nil because the Kirki plugin does not itself ship a usable POP (Property-Oriented Programming) gadget chain. Object injection is only a primitive; exploitation requires a "gadget" — a class whose magic methods (__destruct, __wakeup, __toString, __call, etc.) perform dangerous operations when an attacker-controlled object graph is reconstructed during deserialization. That gadget must be supplied by another installed plugin or theme. This is the standard "deserialization is only as dangerous as the gadget library present" condition that dominates the WordPress ecosystem, where dozens of co-installed plugins dramatically increase the probability that some chain exists.

Consequently, the true risk is a function of site composition, not the Kirki version alone. A site running Kirki plus a gadget-bearing plugin is exposed; a site running only Kirki is not directly exploitable for RCE. The S:U (Unchanged) scope reflects that the injected object executes within the same security authority as the vulnerable component, and C/I/A:H reflects the potential impact contingent on gadget availability.

CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (score 7.2) should be read with two caveats: (a) the PR:H rating overstates the barrier given the Editor default-access configuration, and (b) the scores assume a POP chain is present, which the base description says is not guaranteed. Treat 7.2 as a ceiling-risk figure for gadget-laden sites and a near-zero figure for bare installs.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is known for CVE-2026-104734 at the time of writing; the chain below is inferred from the vulnerability class and the confirmed access-control detail. The precise request parameter carrying the serialized payload is not published, so step 2 describes the class-level trigger rather than a specific field.

1. Reconnaissance / target identification. An attacker identifies WordPress sites running the Kirki plugin at a version <= 6.3.2. Fingerprinting is trivial because plugin assets are served from the predictable wp-content/plugins/kirki/ path, and /wp-json/ or page source reveals plugin presence. The attacker prioritizes targets where they hold (or can obtain) Editor credentials — purchased, phished, reused, or provisioned for content contributors.

2. Triggering the flaw. Authenticated as an Editor, the attacker submits a crafted request to the plugin's import endpoint. Because KIRKI_USERS_DEFAULT_FULL_ACCESS grants Editors full access by default, no privilege escalation to Administrator is required. The request body carries a serialized PHP object graph — attacker-chosen class names instantiated with attacker-chosen properties — which the endpoint passes to PHP deserialization. At this stage only the primitive is delivered; the object is reconstructed in memory.

3. Payload / gadget invocation. Deserialization itself performs no harmful action unless the site hosts a class whose magic methods act on the injected properties. If such a POP chain exists in any other installed plugin or theme, the reconstructed object triggers that chain when PHP invokes the relevant magic method (e.g., on object destruction at request shutdown). If no chain is present, the injected object is inert and the attempt fails — matching the description's statement that the vulnerability "has no impact unless another plugin or theme containing a POP chain is installed."

4. Post-exploitation impact. Contingent on the gadget discovered, demonstrated outcomes include deleting arbitrary files, retrieving sensitive data, or executing code — per the NVD description. Code execution in the WordPress web context typically enables webshell placement, persistence via theme/plugin file modification, database credential theft from wp-config.php, and lateral movement to the underlying host or adjacent services. File-deletion gadgets enable defacement or denial of service; data-retrieval gadgets enable exfiltration of secrets and user records.

The overriding operational lesson: an Editor account on a Kirki-equipped site is not merely a content role — it is an object-injection foothold whose severity is determined entirely by what else is installed.

Impact Assessment

Confidentiality — High. Where a retrieval-type gadget exists, the attacker can read files and data accessible to the web server process, including configuration secrets and database credentials.

Integrity — High. File-deletion and code-execution gadgets permit modification or destruction of application files; code execution allows arbitrary site alteration and persistence.

Availability — High. Arbitrary file deletion and remote code execution can render the site inoperable or hijackable.

Blast radius. The primary unit of exposure is the individual WordPress site. Multi-site (WordPress multisite) deployments and shared-hosting environments raise the stakes, since a single compromised Editor account can affect all tenants on that install or, via host-level lateral movement, neighboring sites. Because the trigger is a legitimate authenticated feature (import), exploitation blends with normal administrative traffic and generates little network-level noise.

Exploitability qualifiers. Real-world risk is bimodal: high for the large fraction of production sites that run dozens of plugins (gadget-rich), and negligible for minimal installs. The PR:H CVSS subscore understates true exposure given Editor-level default access. No exploitation in the wild is documented, EPSS is unscored, and the CVE is not in CISA KEV — so urgency is driven by the value of a site's Editor credentials and its plugin portfolio, not by active campaigns.

Detection Guidance

Sigma Rule

title: WordPress Kirki Plugin Object-Injection Import Abuse
id: 8f3c2a10-kirki-502-import
status: experimental
description: Detects Editor-level authenticated requests to the Kirki plugin import endpoint carrying serialized PHP object payloads indicative of CWE-502 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104734
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_endpoint:
    cs-method: 'POST'
    cs-uri-query|contains: '/kirki'
  selection_import:
    cs-uri-query|contains:
      - 'import'
      - 'admin-ajax.php'
  selection_serialized:
    cs-body|contains:
      - 'O:'
      - 'a:'
  filter_legit_content:
    sc-status: 200
    cs-uri-query|contains: 'action=heartbeat'
  condition: selection_endpoint and selection_import and selection_serialized and not filter_legit_content
fields:
  - c-ip
  - cs-uri-query
  - cs-method
falsepositives:
  - Legitimate settings imports by administrators containing serialized arrays
level: medium

YARA Rule

rule CVE_2026_104734_Kirki_Object_Injection
{
    meta:
        description = "Detects serialized PHP object payloads targeting Kirki import endpoint (CWE-502)"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-104734"
        author      = "valtersit.com"
        date        = "2026-01-01"
        cve         = "CVE-2026-104734"

    strings:
        $phpobj   = /O:[0-9]{1,3}:"[A-Za-z_\\][A-Za-z0-9_\\]{2,120}":/
        $phpobj2  = /O:[0-9]{1,3}:"[A-Za-z0-9_\\\\]+":/
        $magic    = /__(destruct|wakeup|toString|call|invoke)/
        $kirki    = "kirki" nocase
        $import   = "import" nocase

    condition:
        $kirki and $import and 2 of ($phpobj, $phpobj2, $magic)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104734 Kirki Plugin Serialized Object Injection Attempt"; flow:established,to_server; content:"POST"; http_method; content:"kirki"; http.uri; nocase; content:"O:"; http.request_body; pcre:"/O:\d{1,3}:\"[A-Za-z_\\\\][A-Za-z0-9_\\\\]{2,120}\":\d+:\{/"; reference:cve,2026-104734; classtype:attempted-user; sid:2026104734; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=2m
  [ network where http.request.method == "POST" and
      http.request.uri : ("*kirki*" or "*admin-ajax.php*") ]
  [ network where http.request.method == "POST" and
      http.request.body.content : ("*O:*" and "*kirki*") ]

Splunk SPL Query

index=web_logs sourcetype=access_combined
    (uri_path="*kirki*" OR uri_query="*kirki*" OR uri_query="*admin-ajax*")
    http_method=POST
    (form_data="*O:*" OR file_data="*O:*")
| eval serialized_object=if(match(form_data."".file_data, "O:\d+:\"[A-Za-z_\\\\]"), "yes", "no")
| where serialized_object="yes"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths by src_ip, user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,cve_2026_104734,">
  <rule id="2026104" level="10">
    <if_sid>31103,31104,31108,31161</if_sid>
    <match>kirki</match>
    <regex type="pcre2">O:\d{1,3}:"[A-Za-z_\\][A-Za-z0-9_\\]{2,120}":\d+:\{|O:\d{1,3}:"[A-Za-z_\\]</regex>
    <description>CVE-2026-104734: PHP Object Injection attempt against Kirki import endpoint (CWE-502)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,php_object_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (NVD) asserts a patch exists, but no specific fixed version is confirmed and no vendor advisory was independently verified. The latest affected version enumerated is 6.3.2. Do not assume any particular release is the fix; validate against the plugin vendor before relying on it.

1. Immediate mitigations (no confirmed patch required):

   • Remove or disable the Kirki plugin on sites that do not require it; this eliminates the import endpoint entirely.
   • Restrict Editor-level access to the import endpoint. The core exposure is KIRKI_USERS_DEFAULT_FULL_ACCESS granting Editors full access by default. Override this configuration so only trusted administrators retain full access to import functionality, removing the low-privilege path central to exploitation.
   • Audit-and-minimize the plugin/theme portfolio. Since impact requires an external POP chain, disabling unused plugins and themes with known gadget classes materially shrinks the attack surface — a site with no gadget library is not exploitable for the real consequences.
   • Enforce least privilege on Editorial accounts — audit for stale or over-provisioned Editor users, enforce strong authentication and MFA, and prefer custom roles with reduced capabilities.

2. Patch / upgrade steps: Confirm with the vendor the exact version that addresses CVE-2026-104734. Once verified, upgrade Kirki beyond 6.3.2 and re-test that the import endpoint now validates/rejects untrusted serialized input. Because patch confidence is limited, treat post-upgrade as mitigated, not proven fixed, and retain detection coverage.

3. Long-term hardening: Adopt a plugin lifecycle policy (inventory, vulnerability scanning, timely removal of abandoned plugins); implement web application firewall rules inspecting POST bodies to WordPress admin endpoints for serialized-object patterns; enforce role-based access reviews and monitored administrative actions; and log/track authenticated POSTs to plugin import endpoints for anomaly detection.

References

• NVD — CVE-2026-104734: https://nvd.nist.gov/vuln/detail/CVE-2026-104734
• MITRE CWE-502 (Deserialization of Untrusted Data): https://cwe.mitre.org/data/definitions/502.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• First.org EPSS (not yet scored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-104734 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit-in-the-wild evidence, or associated threat-actor campaign is documented for CVE-2026-104734 at this time.