Kirki, a 500,000-install WordPress plugin, lets any subscriber become admin
CVE-2026-75891 lets a subscriber-level account exploit a missing capability check and a PHP object injection chain to overwrite the WordPress admin password.
Kirki, a WordPress plugin with over 500,000 active installs, has a privilege-escalation bug tracked as CVE-2026-75891, publicly disclosed on 27 October. It’s rated CVSS 8.8.
The flaw sits in the kirki_post_apis() AJAX dispatcher’s ‘get-single-symbol’ branch, which is missing a capability check. Any authenticated account, including the lowest WordPress role, subscriber, can use it to inject a PHP object. Where the site also has a usable POP chain, that injection lets an attacker overwrite the administrator’s password and take over the account. The bug affects every release up to and including Kirki 6.2.5; the plugin’s current version is 6.4.0.
Why it matters: subscriber accounts are the ones sites hand out freely, through open registration, membership plugins or a WooCommerce checkout, so “needs an account” isn’t the same as “needs trust.” If your site runs Kirki and hasn’t been updated past 6.2.5, do it now. 500,000 installs makes this the kind of bug that gets mass-scanned once a public writeup exists.
The caveat: Themeum, Kirki’s maker, hasn’t published its own advisory naming this CVE as far as I can find, so this is sourced from Strix, a CVE aggregator. I also couldn’t confirm the exact version where the fix landed, only that it affects releases up to 6.2.5 and that current releases are unaffected.