Kirki: Privilege escalation via PHP object injection (CVE-2026-75891)

The Kirki plugin for WordPress contains a vulnerability in the 'get-single-symbol' branch of the 'kirki_post_apis()' AJAX dispatcher. A missing capability check allows authenticated users with subscriber-level permissions to trigger the deserialization of untrusted input. The availability of a gadget chain (POP chain) enables attackers to overwrite administrator passwords, resulting in full administrative access.

Attack Chain

1. Attacker obtains authenticated access at the subscriber level.
2. Attacker invokes the 'kirki_post_apis()' AJAX dispatcher.
3. Attacker targets the 'get-single-symbol' branch.
4. Attacker submits crafted, serialized PHP input due to missing capability validation.
5. Application deserializes the input, triggering an embedded POP chain.
6. The POP chain execution results in the modification of administrative credentials.
7. Attacker logs in with the newly set administrative credentials.

Impact

Successful exploitation allows an authenticated low-privileged user to gain full administrative control over the WordPress site, leading to potential full system compromise, data exfiltration, and unauthorized site configuration changes.

Recommendation

• Update the Kirki plugin to a version beyond 6.2.5 once a patch is made available by the vendor.
• Audit WordPress user accounts for suspicious privilege changes or unrecognized administrative users.
• Review web server access logs for anomalous POST requests directed at the 'kirki_post_apis()' AJAX handler by low-privileged user accounts.