CVE-2026-75891
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The Kirki plugin for WordPress in versions up to and including 6.2.5 is vulnerable to privilege escalation via PHP Object Injection. The flaw stems from a missing capability check in the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher and deserialization of untrusted input, allowing authenticated attackers with Subscriber-level access and above to inject a PHP object. A POP chain enables overwriting an administrator's password and gaining administrative access.
Risk Assessment
An authenticated low-privileged attacker can gain full administrative control of the WordPress site, leading to complete compromise of the website and its data. This poses a serious risk to confidentiality, integrity, and availability.
Recommendation
Update the Kirki plugin to a version later than 6.2.5 as soon as it is available, and consider disabling it or restricting access to the AJAX functionality in the meantime. Review logs for suspicious requests to kirki_post_apis().
Other vulnerabilities in Kirki WordPress plugin
See all- CVE-2026-84224Medium
The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.
- CVE-2026-84220Medium
The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields of the page being viewed.
- CVE-2026-18335Medium
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- CVE-2026-84223Medium
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.
- CVE-2026-17037High
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CVE-2026-84222Medium
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones.
- CVE-2026-84219High
The Kirki WordPress plugin before 6.3.0 does not properly handle all HTML entities when rendering, allowing unauthenticated users to store JavaScript in a comment that executes in the session of anyone viewing the page, including an administrator, and on every page when the header or footer is built to show comments.
Original NVD description (English source)
The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher due to a missing capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to overwrite an administrator's password and gain administrative access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS