CVE-2026-75891: Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint
The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirkipostapis() AJAX dispatcher due to a missing capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to overwrite an administrator's password and gain administrative access.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated to WordPress with at least Subscriber-level access. No user interaction is required.
What access could an attacker gain?
An attacker can use PHP object injection and the available POP chain to overwrite an administrator password, resulting in administrative access to the WordPress site.
Which installations are affected?
Kirki versions up to and including 6.2.5 are affected. The vulnerable functionality is the get-single-symbol branch of the kirki_post_apis() AJAX dispatcher.
What is the underlying access-control issue?
The affected AJAX endpoint deserializes untrusted input without a required capability check. As a result, low-privileged authenticated users can reach functionality that should be restricted.