CVE-2026-75891: 
WordPress vulnerability analysis and mitigation

CVE-2026-75891 is a Privilege Escalation vulnerability via PHP Object Injection in the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress, developed by Themeum. It affects all versions up to and including 6.2.5. The flaw allows authenticated attackers with Subscriber-level access or above to inject a PHP object through the get-single-symbol branch of the kirki_post_apis() AJAX dispatcher, and leverage a POP chain to overwrite an administrator's password and gain full administrative access. It carries a CVSS v3.1 base score of 8.8 (High) (Wordfence, EUVD).

The root cause is deserialization of untrusted input (CWE-502) within the kirki_post_apis() AJAX dispatcher, specifically in the get-single-symbol branch, which lacks a proper capability check before processing user-supplied data. An authenticated attacker with at minimum Subscriber-level access can craft a malicious serialized PHP object and submit it via an AJAX request to this endpoint. The presence of a Property-Oriented Programming (POP) chain within the plugin's codebase then allows the injected object to trigger a sequence of method calls that ultimately overwrites an administrator account's password (Wordfence, WordPress Changeset).

Successful exploitation grants an attacker full administrative control over the affected WordPress site, enabling them to install malicious plugins or themes, exfiltrate sensitive data (including user credentials and personal information), deface content, or use the site as a pivot point for further attacks. The impact spans all three security pillars — confidentiality, integrity, and availability — as an attacker with admin access can read, modify, or delete any site content and configuration (Wordfence).

As of the time of disclosure (October 27, 2026), there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Wordfence). The EPSS score is reported at 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low barrier to exploitation — requiring only a Subscriber-level account — makes it a significant risk for sites with open user registration.

1. Reconnaissance: Identify WordPress sites running the Kirki plugin version 6.2.5 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible readme files.
2. Obtain Subscriber Access: Register a low-privilege account on the target WordPress site (if open registration is enabled) or use compromised Subscriber-level credentials.
3. Craft Malicious Payload: Construct a serialized PHP object that, when deserialized, triggers the available POP chain within the Kirki plugin codebase to overwrite an administrator's password.
4. Submit AJAX Request: Send an authenticated HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action targeting the get-single-symbol branch of kirki_post_apis(), including the crafted serialized payload in the request body.
5. Trigger Deserialization: The server deserializes the untrusted input without capability validation, executing the POP chain and overwriting the target administrator's password.
6. Gain Admin Access: Log in to the WordPress admin panel using the administrator's username and the newly set password, achieving full site control (Wordfence, WordPress Changeset).

• Network: Unusual authenticated POST requests to /wp-admin/admin-ajax.php with action parameters related to kirki AJAX handlers from low-privilege user sessions; serialized PHP data (O: patterns) in POST body parameters.
• Logs: WordPress access logs showing repeated AJAX requests to admin-ajax.php from Subscriber-level accounts; unexpected admin login events following such requests, particularly from new or rarely used accounts.
• File System: Unexpected changes to WordPress core files or newly installed plugins/themes after the suspicious AJAX activity; modified wp_users or wp_usermeta database entries reflecting password changes for administrator accounts.
• Process: Unusual PHP processes spawned from the web server user account; unexpected outbound connections from the web server following exploitation.

Site administrators should update the Kirki plugin to a version beyond 6.2.5 immediately, as the patch (available via the WordPress plugin repository changeset) adds the missing capability check to the affected AJAX dispatcher branch (WordPress Changeset). As a temporary workaround, disabling open user registration to prevent unauthenticated users from obtaining Subscriber accounts reduces the attack surface. Additionally, implementing a Web Application Firewall (WAF) rule to block serialized PHP objects in AJAX requests can provide an interim layer of defense (Wordfence).

The vulnerability was reported and assigned by Wordfence, a leading WordPress security firm, and was disclosed on October 27, 2026. Brief mentions appeared on Mastodon security communities shortly after disclosure. No significant vendor statements beyond the patch commit or notable media coverage have been identified at this time (Wordfence).