Live › vulnerability › CVE-2026-75891
Go to dashboardThe Kirki plugin for WordPress, up to and including 6.2.5, deserializes untrusted input in an AJAX handler that lacks a capability check. An authenticated subscriber can inject a PHP object and, through a POP chain, overwrite an administrator's password to gain admin access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 07:30 UTC. All times on this page are UTC.
Sites running the Kirki WordPress plugin at version 6.2.5 or earlier are exposed. The attacker needs a logged-in account at Subscriber level or above, so sites with open registration or untrusted user accounts are at highest risk. Sites without Kirki installed or with a fixed version can skip it.
No product ranges from the sources yet.
wp plugin get kirki --field=version6.2.5; the sources do not name the exact fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher due to a missing capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to overwrite an administrator's password and gain administrative access.
This page as .md · .json · in your agent: get_signal("CVE-2026-75891")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.