Skip to content
Threat Feed
Subscribe

Product

Kirki (< 6.4.1)

1 brief RSS
high advisory

Kirki: Privilege escalation via PHP object injection (CVE-2026-75891)

An authenticated PHP object injection vulnerability in the Kirki WordPress plugin allows attackers with subscriber-level access to escalate privileges to administrator via a POP chain.

PoC Kirki +1 wordpress plugin vulnerability php-injection privilege-escalation web-application access-control cve-2026-112347
1r 1t 2c updated