Kirki: Privilege escalation through PHP object injection
Kirki 6.2.5 and earlier deserializes untrusted input in the get-single-symbol branch of the kirki_post_apis() AJAX dispatcher without the required capability check. A Subscriber or higher-privilege user can inject a PHP object. Overwriting an administrator’s password and gaining administrator access additionally requires a usable POP chain; object injection alone does not establish that result on every installation. The serialized-input parameter and the required POP-chain classes are not disclosed.
- Component
- Kirki – Freeform Page Builder, Website Builder & Customizer
- Plugin slug
kirki- Affected
- <= 6.2.5
- Safe version
- See mitigation notes
- Published
- Oct 27, 2026
This CVE was published Oct 27, 2026 and is one of 42 known issues for this plugin.
Update, patch or deactivate.
Official author notes reviewed on 2026-10-27 through Kirki 6.4.0 did not establish the exact fixed version for this CVE. The 6.3.0 blanket statement about known security vulnerabilities does not identify this deserialization path; the older 6.2.4 POST-API note is inside the authoritative affected range and cannot be treated as its fix. A newer release may resolve the issue, but this archive’s uncertainty does not establish that the current release remains vulnerable. Until a matching fix is confirmed, disable the affected integration where feasible. Enforce the intended capability checks before dispatch and avoid deserializing attacker-controlled data into PHP objects; use a format that cannot instantiate objects. Review unexpected administrator password or account changes. Official author notes: https://wordpress.org/plugins/kirki/#developers.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher due to a missing capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to overwrite an administrator's password and gain administrative access.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H