Skip to content
Threat Feed
Subscribe

Product

Kirki (<= 6.2.5)

1 brief RSS
high advisory

Kirki: Privilege escalation via PHP object injection (CVE-2026-75891)

An authenticated PHP object injection vulnerability in the Kirki WordPress plugin allows attackers with subscriber-level access to escalate privileges to administrator via a POP chain.

PoC Kirki wordpress plugin vulnerability php-injection privilege-escalation
1r 1t 1c