Kirki WordPress plugin: PHP Object Injection leading to administrator takeover
Summary
The Kirki plugin for WordPress, used for theme customization and as a visual page builder, is affected in all versions up to and including 6.2.5. An authenticated attacker with at least Subscriber access can send a crafted request to the 'get-single-symbol' AJAX endpoint, which deserializes untrusted input because a capability check is missing. With a PHP object chain present on the site, the attacker can overwrite an administrator's password and take over the administrator account.
Affected
- Kirki (Freeform Page Builder, Website Builder & Customizer) WordPress plugin, all versions up to and including 6.2.5
- Requires an authenticated account with Subscriber role or higher
Fixed in
Unknown. The fixed version could not be confirmed. Check the Wordfence advisory and the WordPress plugin changeset for the first patched release.
Workaround
- Unknown. No vendor-confirmed workaround.
- Temporarily restrict the affected AJAX handler to administrators only, or disable the Kirki plugin if it is not required.
Exploitation
- CISA SSVC assessment: exploitation none known, not automatable, technical impact total.
- EPSS score 0.31 % (percentile 23) at the time of research.
- Public proof-of-concept references were listed by some aggregators; their reliability was not verified.
Our recommendation
- Identify all WordPress sites with Kirki installed, including copies bundled inside themes or plugins.
- Update Kirki to a version newer than 6.2.5 as soon as a fixed release is confirmed from the vendor changeset.
- Until then, remove unneeded Subscriber accounts, restrict registration, and disable Kirki if it is not essential.
- Review administrator accounts and passwords for unexpected changes and monitor AJAX requests to kirki_post_apis.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence record www.wordfence.com
- WordPress plugin changeset plugins.trac.wordpress.org
- WordPress.org Kirki plugin page wordpress.org
- Kirki CHANGELOG (Themeum) github.com
- CVE-2026-75891 on OpenCVE app.opencve.io
- CVE-2026-75891 on THN/TheHackerWire www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:16.
Original description (NVD)
The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher due to a missing capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to overwrite an administrator's password and gain administrative access.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.