8.8
High
CVE-2026-75891 The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and…
Description
The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher due to a missing capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to overwrite an administrator's password and gain administrative access.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Kirki – Freeform Page Builder, Website Builder & Customizer 6.2 | earliest → 6.2.5 | No fix stated |
Other CVEs of Kirki – Freeform Page Builder, Website Builder & Customizer
The 19 CVEs of Kirki – Freeform Page Builder, Website Builder & Customizer →
CVE-2026-104734
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object…
7.2
High
CVE-2026-107762
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct…
7.5
High
CVE-2026-14572
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored…
6.4
Medium
CVE-2026-102291
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary…
5.4
Medium