Advisory · CVE-2026-75891
Kirki WordPress plugin object injection lets a subscriber-level account overwrite an administrator password
The Kirki plugin for WordPress, in versions up to and including 6.2.5, deserializes untrusted input through an AJAX branch with no capability check, so an authenticated subscriber-level attacker can inject a PHP object and, through the chain in the record, overwrite an administrator password and gain administrative access. CVSS 3.1 8.8.
- Vendor
- Themeum
- Product
- Kirki
- Identifier / CWE
- CVE-2026-75891
CWE-502 - Action timing
- Immediate
Explain it like I’m five
A low-level logged-in account can send the plugin a rigged serialized object through a door that never checks who is allowed in. The plugin unpacks the object, the rigged chain fires, and the attacker can reset the administrator password and walk in as the site owner.
- 01Subscriber account signs in
The attacker holds any authenticated account at Subscriber level or above on a site running Kirki up to 6.2.5.
- 02AJAX branch called
The attacker calls the get-single-symbol branch of the kirki_post_apis() AJAX dispatcher, which the record states has no capability check.
- 03Object is deserialized
The branch deserializes attacker-supplied input, injecting a PHP object into the request handling.
- 04Chain fires
Per the record, the POP chain present in the plugin lets the injected object reach an administrator password overwrite.
- 05Administrative access gained
The attacker signs in with the overwritten administrator password and controls the site.
What happened
Wordfence disclosed CVE-2026-75891, published in NVD on October 27, 2026 and rated high at CVSS 3.1 8.8: the Kirki plugin for WordPress is vulnerable to PHP object injection (CWE-502) in all versions up to and including 6.2.5, via deserialization of untrusted input through the get-single-symbol branch of the kirki_post_apis() AJAX dispatcher, due to a missing capability check. Per the record, authenticated attackers with Subscriber-level access and above can inject a PHP object, and the additional presence of a POP chain allows them to overwrite an administrator password and gain administrative access.
The changeset the NVD record references for this issue is the plugin repository changeset that tagged Kirki 6.3.0, and the 6.3.0 changelog on the vendor’s WordPress.org plugin page states that the release addressed all known security vulnerabilities. On that basis, sites should update to Kirki 6.3.0 or later; the affected range stated in the record ends at 6.2.5. Kirki is widely deployed: Wordfence reported more than 500,000 active installations for the plugin earlier in 2026.
What to do
- Inventory WordPress sites running the Kirki plugin and note the version of each, including staging and client sites.
- Update Kirki to version 6.3.0 or later on every site running 6.2.5 or earlier, and verify the deployed version afterwards.
- Until a site is updated, consider disabling open user registration and removing subscriber accounts you do not recognize, because any low-privilege account can attempt this.
- Review administrator accounts for password changes you did not make, new or unexpected admin users, and recent logins from unfamiliar addresses.
- If an unexplained administrator password change or takeover indicator is found, reset administrator passwords, rotate WordPress salts and any credentials reachable from the site, and scan the site for added files or content.
- Check whether themes or other plugins on the site bundle Kirki components, and update those packages as well.
Management note
Half a million sites run this plugin, and the attack needs only the cheapest account a WordPress site hands out. Any site that allows public registration should treat the update as urgent, and an administrator password nobody remembers changing is a compromise indicator, not an inconvenience.