CVE-2026-75891

Name of the Vulnerable Software and Affected Versions Kirki versions prior to 6.2.6

Description Privilege escalation is possible through PHP Object Injection, which occurs when untrusted input is deserialized. This issue exists in the 'get-single-symbol' branch of the kirki post apis() AJAX dispatcher due to a missing capability check. Authenticated users with Subscriber-level access or higher can inject a PHP Object. By utilizing a POP chain (a sequence of gadgets used to execute arbitrary code during deserialization), an attacker can overwrite an administrator's password to gain full administrative access.

Recommendations Update to version 6.2.6 or later.