CVE-2026-75891
Received Received - Intake

Privilege Escalation via PHP Object Injection in Kirki WordPress Plugin

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: Wordfence

Description
The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher due to a missing capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to overwrite an administrator's password and gain administrative access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-75891
EUVD
EUVD-2026-110629

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
themeum Kirki – Freeform Page Builder, Website Builder & Customizer 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Kirki plugin for WordPress has a vulnerability that allows privilege escalation through PHP Object Injection. This flaw exists in versions up to 6.2.5 due to improper deserialization of untrusted input in the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher. The issue arises because there is no capability check, enabling authenticated attackers with Subscriber-level access or higher to inject a PHP Object. If a POP (Property-Oriented Programming) chain is present, attackers can overwrite an administrator's password and gain full administrative access.

Detection Guidance

Check for the Kirki plugin version 6.2.5 or lower in your WordPress installation. Look for unauthorized administrative access or suspicious activity in user logs. Use WordPress security plugins to scan for known vulnerabilities.

Impact Analysis

This vulnerability allows attackers with basic user access to escalate their privileges to administrative levels. Once exploited, attackers can take control of the WordPress site, modify content, install malicious plugins, steal sensitive data, or disrupt site operations. The impact includes unauthorized access, data breaches, and potential site defacement or takeover.

Compliance Impact

This vulnerability can lead to unauthorized access and data breaches, which may violate compliance requirements under GDPR and HIPAA. GDPR requires protecting personal data, and a breach could result in fines or legal consequences. HIPAA mandates safeguarding protected health information, and exploitation could lead to unauthorized access, triggering compliance violations and penalties.

Mitigation Strategies

Update the Kirki plugin to the latest version if available. Remove or disable the plugin if no update is available. Implement strict user role permissions and monitor for unauthorized administrative changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75891. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart