Description
Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Themeum | Kirki | ≤ 6.0.12 | — |
Critical · 9.8
CVE-2026-57724
EUVD-2026-43377GHSA-hm97-5498-hwc7
WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability
Published Jul 13, 2026 · Updated Jul 13, 2026 · Assigned by Patchstack