Kirki (<= 6.2.5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/kirki--6.2.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 07:49:02 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgKirki: Privilege escalation via PHP object injection (CVE-2026-75891)https://feed.craftedsignal.io/briefs/2026-10-kirki-plugin-privilege-escalation/Tue, 27 Oct 2026 07:49:02 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-kirki-plugin-privilege-escalation/An authenticated PHP object injection vulnerability in the Kirki WordPress plugin allows attackers with subscriber-level access to escalate privileges to administrator via a POP chain.The Kirki plugin for WordPress contains a vulnerability in the 'get-single-symbol' branch of the 'kirki_post_apis()' AJAX dispatcher. A missing capability check allows authenticated users with subscriber-level permissions to trigger the deserialization of untrusted input. The availability of a gadget chain (POP chain) enables attackers to overwrite administrator passwords, resulting in full administrative access.

Attack Chain

  1. Attacker obtains authenticated access at the subscriber level.
  2. Attacker invokes the 'kirki_post_apis()' AJAX dispatcher.
  3. Attacker targets the 'get-single-symbol' branch.
  4. Attacker submits crafted, serialized PHP input due to missing capability validation.
  5. Application deserializes the input, triggering an embedded POP chain.
  6. The POP chain execution results in the modification of administrative credentials.
  7. Attacker logs in with the newly set administrative credentials.

Impact

Successful exploitation allows an authenticated low-privileged user to gain full administrative control over the WordPress site, leading to potential full system compromise, data exfiltration, and unauthorized site configuration changes.

Recommendation

  • Update the Kirki plugin to a version beyond 6.2.5 once a patch is made available by the vendor.
  • Audit WordPress user accounts for suspicious privilege changes or unrecognized administrative users.
  • Review web server access logs for anomalous POST requests directed at the 'kirki_post_apis()' AJAX handler by low-privileged user accounts.
]]>highadvisorywordpresspluginvulnerabilityphp-injectionprivilege-escalation