8.8
Élevée
CVE-2026-75891 The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and…
Description
The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher due to a missing capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to overwrite an administrator's password and gain administrative access.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Kirki – Freeform Page Builder, Website Builder & Customizer 6.2 | premières → 6.2.5 | Pas de correctif indiqué |
Autres CVE de Kirki – Freeform Page Builder, Website Builder & Customizer
Les 19 CVE de Kirki – Freeform Page Builder, Website Builder & Customizer →
CVE-2026-104734
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object…
7.2
Élevée
CVE-2026-107762
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct…
7.5
Élevée
CVE-2026-14572
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored…
6.4
Moyenne
CVE-2026-102291
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary…
5.4
Moyenne