Summary
This advisory addresses CVE-2026-75891, a Privilege Escalation vulnerability through PHP Object Injection. It affects the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress, in versions up to and including 6.2.5. The vulnerability is patched in version 6.3.0 and later. There is no evidence of active exploitation.
Affected and patched versions
Kirki – Freeform Page Builder, Website Builder & Customizer (plugin kirki): affected 6.2.5 and earlier; fixed in 6.3.0
Is my site vulnerable?
To determine if your WordPress site is running a vulnerable version of the Kirki plugin, follow these steps:
Log into your WordPress administration dashboard.
Navigate to the "Plugins" section from the left-hand menu.
Locate "Kirki – Freeform Page Builder, Website Builder & Customizer" in the list of installed plugins.
The version number is displayed directly beneath the plugin's name.
If the displayed version is 6.2.5 or any earlier version, your site is vulnerable to this issue.
What an attacker actually does
This vulnerability allows an authenticated attacker to gain administrative access to a WordPress site running affected versions of the Kirki plugin. The core of the issue lies in how the plugin processes certain data without proper validation. Specifically, the kirki_post_apis() AJAX dispatcher, through its 'get-single-symbol' branch, deserializes untrusted input. This process occurs without a necessary capability check, meaning even users with low-level permissions, such as a Subscriber, can initiate the attack. The absence of this check is critical, as it bypasses the security measures designed to restrict sensitive operations to higher-privileged users.
An attacker leverages this flaw by crafting a special piece of malicious data, known as a PHP Object, and sending it to the vulnerable AJAX endpoint. Because the plugin deserializes this untrusted input, the attacker's carefully constructed object is processed by the server as if it were legitimate data. This deserialization process, when applied to untrusted input, can lead to the execution of arbitrary code or manipulation of application logic. The additional presence of a "Property Oriented Programming" (POP) chain within the plugin's codebase then allows this injected PHP Object to execute unintended actions. A POP chain is a sequence of legitimate code gadgets (small pieces of code) that, when chained together through object deserialization, can achieve a malicious outcome.
The specific action facilitated by this POP chain is the overwriting of an existing administrator's password. By changing an administrator's credentials, the attacker effectively takes over an administrative account. This grants them full control over the affected WordPress website, enabling them to modify content, install malicious plugins, inject malware, or perform other actions typically reserved for site administrators. Such an account takeover can lead to significant data breaches, website defacement, or the use of the compromised site for further malicious activities. This type of vulnerability is considered highly dangerous and is anticipated to be targeted in widespread attack campaigns, affecting numerous websites irrespective of their traffic or popularity.
How to detect a compromise
Detecting a compromise related to this specific vulnerability primarily involves looking for indicators of unauthorized administrative access and unusual activity within your WordPress environment. Since the attack aims to overwrite an administrator's password and gain control, the most direct signs would be unexpected changes to administrative accounts or site settings.
Begin by reviewing the list of users in your WordPress dashboard. Look for any new administrator accounts that you did not create, or existing administrator accounts with changed email addresses, usernames, or roles. If an administrator reports being locked out of their account, or that their password no longer works, this could indicate a successful compromise where their credentials have been altered by an attacker. It is important to cross-reference user activity logs, if available, to identify any login attempts or actions from these suspicious accounts.
Examine your WordPress database for unauthorized modifications. Specifically, check the wp_users table for any unexpected changes to user passwords or roles, particularly for administrator accounts. The user_pass field would show a new hash, and the wp_capabilities field might show altered roles. You can use a tool like phpMyAdmin or a database management plugin to inspect these tables directly. Look for recent modifications that do not align with legitimate administrative actions.
Server access logs and WordPress debug logs may contain evidence of suspicious activity. Pay close attention to unusual or repeated requests to the wp-admin/admin-ajax.php endpoint, specifically targeting the action=kirki_post_apis parameter with the branch=get-single-symbol value. While the exact payload of a PHP Object Injection attack will vary, an unusual volume or pattern of requests from a low-privileged user account to this specific endpoint, especially if originating from unexpected IP addresses, could be a strong sign of attempted exploitation. Look for entries indicating deserialization errors or unexpected PHP warnings that might be triggered by malformed objects.
A compromise might also manifest as unexpected changes to your website's content, themes, or plugins, as an attacker with administrative access can make such modifications. This includes new posts or pages, altered existing content, installation of unfamiliar plugins or themes, or modifications to core WordPress files. Regularly back up your site and compare current files and database entries against known good backups to identify discrepancies. Tools for file integrity monitoring can also help detect unauthorized changes to your WordPress installation files.
How to fix
Update the Kirki – Freeform Page Builder, Website Builder & Customizer plugin to version 6.3.0 or later immediately. This version contains the patch that addresses the Privilege Escalation vulnerability.
Log into your WordPress administration dashboard.
Navigate to the "Plugins" section.
Locate "Kirki – Freeform Page Builder, Website Builder & Customizer" in the list.
Click on the "Update Now" link if an update is available. If no update link is present, it means you are either on the latest version or need to manually update.
If automatic update fails, download the latest version from the WordPress plugin directory and manually install it.
After updating, verify all administrator accounts on your site. If you suspect a compromise, change all administrator passwords to strong, unique values.
Review your WordPress user list for any unauthorized administrator accounts and remove them.
Implement a Web Application Firewall (WAF) if you do not already have one. Some WAF services have issued mitigation rules to block attacks targeting this vulnerability until the plugin can be updated.
Timeline
Date | Event |
|---|---|
2026-10-27 | CVE Published |
2026-10-27 | Advisory Published |