---
id: "CVE-2026-75891"
kind: "vulnerability"
aliases: ["CVE-2026-75891"]
title: "WordPress Kirki plugin: subscriber can overwrite admin password via object injection"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["kirki", "package", "self-hosted", "wordpress"]
not_affected_if: ["auth-required", "no-subscriber-accounts"]
published_at: "2026-10-27T07:16:32+00:00"
first_seen_at: "2026-10-27T07:30:44+00:00"
updated_at: "2026-10-27T07:31:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75891", "first_seen_at": "2026-10-27T07:30:44+00:00"}]
---

# WordPress Kirki plugin: subscriber can overwrite admin password via object injection

The Kirki plugin for WordPress, up to and including 6.2.5, deserializes untrusted input in an AJAX handler that lacks a capability check. An authenticated subscriber can inject a PHP object and, through a POP chain, overwrite an administrator's password to gain admin access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kirki version in the WordPress admin plugin list or with `wp plugin get kirki --field=version`
- Confirm whether any user with a Subscriber role exists that is not trusted, since the flaw needs that level of access

## Fix

- Update the Kirki plugin to a version newer than `6.2.5`; the sources do not name the exact fixed version
- Rotate administrator passwords if the site ran a vulnerable version with open subscriber registration

## Timeline

- 2026-10-27T07:30:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-75891

## From the sources

The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher due to a missing capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to overwrite an administrator's password and gain administrative access.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_