{"id":"CVE-2026-75891","kind":"vulnerability","aliases":["CVE-2026-75891"],"related":[],"title":"WordPress Kirki plugin: subscriber can overwrite admin password via object injection","description":"The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher due to a missing capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to overwrite an administrator's password and gain administrative access.","summary":"The Kirki plugin for WordPress, up to and including 6.2.5, deserializes untrusted input in an AJAX handler that lacks a capability check. An authenticated subscriber can inject a PHP object and, through a POP chain, overwrite an administrator's password to gain admin access.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kirki","package","self-hosted","wordpress"],"not_affected_if":["auth-required","no-subscriber-accounts"],"how_to_check":"- Check the installed Kirki version in the WordPress admin plugin list or with `wp plugin get kirki --field=version`\n- Confirm whether any user with a Subscriber role exists that is not trusted, since the flaw needs that level of access","fix":"- Update the Kirki plugin to a version newer than `6.2.5`; the sources do not name the exact fixed version\n- Rotate administrator passwords if the site ran a vulnerable version with open subscriber registration","status":"open","published_at":"2026-10-27T07:16:32+00:00","first_seen_at":"2026-10-27T07:30:44+00:00","triaged_at":"2026-10-27T07:31:57+00:00","updated_at":"2026-10-27T07:31:57+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T07:31:57Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Kirki plugin to a version newer than `6.2.5`; the sources do not name the exact fixed version\n- Rotate administrator passwords if the site ran a vulnerable version with open subscriber registration","reach":"internet","title":"WordPress Kirki plugin: subscriber can overwrite admin password via object injection","impact":"high","summary":"The Kirki plugin for WordPress, up to and including 6.2.5, deserializes untrusted input in an AJAX handler that lacks a capability check. An authenticated subscriber can inject a PHP object and, through a POP chain, overwrite an administrator's password to gain admin access.","category":"package","nicknames":[],"who_cares":["wordpress","kirki","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker takes over an administrator account and gains full site control","analyst_note":"Find the first fixed Kirki version and confirm the default configuration exposes the get-single-symbol AJAX action, via the NVD entry or the plugin changelog.","how_to_check":"- Check the installed Kirki version in the WordPress admin plugin list or with `wp plugin get kirki --field=version`\n- Confirm whether any user with a Subscriber role exists that is not trusted, since the flaw needs that level of access","needs_analyst":true,"not_affected_if":["auth-required","no-subscriber-accounts"],"who_is_affected":"Sites running the Kirki WordPress plugin at version `6.2.5` or earlier are exposed. The attacker needs a logged-in account at Subscriber level or above, so sites with open registration or untrusted user accounts are at highest risk. Sites without Kirki installed or with a fixed version can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000657,"input_tokens":3404,"output_tokens":633,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-75891':14A,17A '6.2.5':33B,89C 'access':67B,126C,152C 'addit':135C 'admin':7A,66B 'administr':61B,146C,151C 'ajax':39B,107C 'allow':141C 'api':106C 'attack':121C,142C 'authent':47B,120C 'branch':101C 'capabl':44B,113C 'chain':58B,140C 'check':45B,114C 'cve':12A,15A 'deseri':34B,91C 'dispatch':108C 'due':109C 'escal':77C 'gain':65B,150C 'get':98C 'get-single-symbol':97C 'handler':40B 'host':22B 'includ':32B,88C 'inject':11A,50B,81C,130C 'input':36B,94C 'kirki':2A,18B,25B,69C,104C 'lack':42B 'level':125C 'make':116C 'miss':112C 'object':10A,53B,80C,133C 'overwrit':6A,59B,144C 'packag':19B 'password':8A,63B,148C 'php':52B,79C,132C 'plugin':3A,26B,70C 'pop':57B,139C 'possibl':118C 'post':105C 'presenc':136C 'privileg':76C 'self':21B 'self-host':20B 'singl':99C 'subscrib':4A,48B,124C 'subscriber-level':123C 'symbol':100C 'untrust':35B,93C 'version':84C 'via':9A,78C,90C 'vulner':74C 'wordpress':1A,23B,28B,72C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Kirki WordPress plugin at version `6.2.5` or earlier are exposed. The attacker needs a logged-in account at Subscriber level or above, so sites with open registration or untrusted user accounts are at highest risk. Sites without Kirki installed or with a fixed version can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T07:16:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-75891","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75891","severity":null,"published_at":"2026-10-27T07:16:32+00:00","modified_at":"2026-10-27T07:16:32+00:00","first_seen_at":"2026-10-27T07:30:44+00:00","fetched_at":"2026-10-27T07:30:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}