CVE-2026-75891 Details
Description
The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher due to a missing capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to overwrite an administrator's password and gain administrative access.
A privilege escalation vulnerability has been identified in the Kirki plugin for WordPress, affecting all versions through 6.2.5. The issue arises from PHP object injection, allowing authenticated attackers with Subscriber-level access and above to exploit deserialization of untrusted input. This vulnerability is present in the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher, where a missing capability check enables the injection of PHP objects. Exploitation of this vulnerability could lead to overwriting an administrator's password, thereby granting administrative access.
Users are advised to update the Kirki WordPress plugin to version 6.3.0 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://plugins.trac.wordpress.org/changeset/3677965/kirki | [email protected] | Content WallVendor |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/aecfea73-97fc-48c3-bf1b-5314077739b5?source=cve | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Kirki | <= 6.2.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |