{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/kirki--6.2.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kirki:kirki:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-75891"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-75891\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Kirki (\u003c= 6.2.5)"],"_cs_severities":["high"],"_cs_tags":["wordpress","plugin","vulnerability","php-injection","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["Kirki"],"content_html":"\u003cp\u003eThe Kirki plugin for WordPress contains a vulnerability in the 'get-single-symbol' branch of the 'kirki_post_apis()' AJAX dispatcher. A missing capability check allows authenticated users with subscriber-level permissions to trigger the deserialization of untrusted input. The availability of a gadget chain (POP chain) enables attackers to overwrite administrator passwords, resulting in full administrative access.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains authenticated access at the subscriber level.\u003c/li\u003e\n\u003cli\u003eAttacker invokes the 'kirki_post_apis()' AJAX dispatcher.\u003c/li\u003e\n\u003cli\u003eAttacker targets the 'get-single-symbol' branch.\u003c/li\u003e\n\u003cli\u003eAttacker submits crafted, serialized PHP input due to missing capability validation.\u003c/li\u003e\n\u003cli\u003eApplication deserializes the input, triggering an embedded POP chain.\u003c/li\u003e\n\u003cli\u003eThe POP chain execution results in the modification of administrative credentials.\u003c/li\u003e\n\u003cli\u003eAttacker logs in with the newly set administrative credentials.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated low-privileged user to gain full administrative control over the WordPress site, leading to potential full system compromise, data exfiltration, and unauthorized site configuration changes.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Kirki plugin to a version beyond 6.2.5 once a patch is made available by the vendor.\u003c/li\u003e\n\u003cli\u003eAudit WordPress user accounts for suspicious privilege changes or unrecognized administrative users.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous POST requests directed at the 'kirki_post_apis()' AJAX handler by low-privileged user accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T08:31:42Z","date_published":"2026-10-27T07:49:02Z","id":"https://feed.craftedsignal.io/briefs/2026-10-kirki-plugin-privilege-escalation/","summary":"An authenticated PHP object injection vulnerability in the Kirki WordPress plugin allows attackers with subscriber-level access to escalate privileges to administrator via a POP chain.","title":"Kirki: Privilege escalation via PHP object injection (CVE-2026-75891)","url":"https://feed.craftedsignal.io/briefs/2026-10-kirki-plugin-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Kirki (\u003c= 6.2.5)","version":"https://jsonfeed.org/version/1.1"}