Privilege Escalation Vulnerability in Kirki Plugin for WordPress

CVE-2026-75891

What is CVE-2026-75891?

The Kirki plugin for WordPress is susceptible to a Privilege Escalation vulnerability due to improper deserialization of untrusted input in the AJAX dispatcher, specifically through the 'get-single-symbol' function of the kirki_post_apis(). This flaw allows authenticated attackers with Subscriber-level access or higher to exploit the vulnerability, enabling them to inject a PHP Object. The existence of a PHP Object Injection (POI) chain makes it feasible for attackers to modify an administrator's password, effectively granting them full administrative privileges. It's crucial for users to ensure they're using a patched version of the plugin to mitigate potential security breaches.

References