Security Alert Summary
The Kirki plugin for WordPress contains a privilege escalation vulnerability via PHP object injection that affects versions up to and including 6.2.5. Authenticated users with Subscriber-level access and above can trigger deserialization of untrusted input through the kirki_post_apis() AJAX dispatcher, potentially allowing an attacker to overwrite an administrator password and gain administrative access.
CVE Details
- CVE ID: CVE-2026-75891
- Affected component: Kirki plugin for WordPress
- Affected versions: All versions up to and including 6.2.5
- Published: October 27, 2026 at 7:16:32 AM UTC
- Last modified: October 27, 2026 at 2:52:13 PM UTC
- CVSS v3.1 base score: 8.8
- CVSS v3.1 severity: HIGH
- CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Authentication / privileges / user interaction: Authentication required. Privileges required: Low (an authenticated user with Subscriber-level access or higher). User interaction: None.
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- Weakness (CWE): CWE-502
Technical Details
The vulnerability is a PHP object injection leading to privilege escalation caused by deserialization of untrusted input. The issue is present in the get-single-symbol branch of the kirki_post_apis() AJAX dispatcher, where a required capability check is missing. Because input is deserialized without proper validation, an authenticated attacker with low privileges can supply crafted data that results in instantiation or manipulation of PHP objects during deserialization.
The advisory notes that the additional presence of a gadget or POP chain allows an attacker to overwrite an administrator’s password and obtain administrative access. The impact stems directly from insecure deserialization combined with missing authorization checks in the AJAX handling code.
How This Could Impact Your Website
On a multi-user WordPress site, a realistic scenario might involve an external contractor or a contributor with Subscriber-level access who unknowingly (or maliciously) submits specially crafted data via an AJAX request handled by the plugin. Because the AJAX branch lacks a capability check, that input can be deserialized and used to perform actions beyond the submitter’s intended permissions.
Practical consequences include exposure or modification of administrator credentials, which could allow an attacker to access user data or change site settings. This increases the risk of targeted phishing or social engineering against staff if internal user email addresses or profile details are accessed. The vulnerability does not require user interaction beyond the authenticated request, making it actionable for low-privilege accounts.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially accounts with Contributor or higher privileges.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual administrative changes or authentication events.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
