Critical Privilege Escalation Vulnerability in Kirki Plugin (CVE-2026-75891)

What is Affected and How Serious It Is

The Kirki plugin for WordPress, a popular toolkit for theme developers that allows for extensive customization via the WordPress Customizer, is affected by a critical security vulnerability identified as CVE-2026-75891. This vulnerability exists in all versions of the plugin up to and including version 6.2.5.

The core of the issue lies in a PHP Object Injection flaw within the kirki_post_apis() AJAX dispatcher. Specifically, it's related to the 'get-single-symbol' branch and a missing capability check during the deserialization of untrusted input. This weakness allows authenticated attackers, even those with the lowest user role (Subscriber), to inject a PHP Object into the system.

The severity of this vulnerability is exceptionally high because it enables Privilege Escalation. When combined with a suitable PHP Object Injection (POP) chain, an attacker can manipulate the object to overwrite an administrator's password. This means an attacker, starting with minimal privileges, can gain full administrative access to the WordPress website. Given that the Kirki plugin has over 500,000 active installations, a significant number of websites are potentially exposed. Furthermore, there are already reports of this vulnerability being actively exploited in the wild, underscoring the urgency of addressing this issue.

You can find more details on the National Vulnerability Database (NVD) page for CVE-2026-75891: https://nvd.nist.gov/vuln/detail/CVE-2026-75891.

Need it patched now? A senior engineer (20+ years in production PHP) applies the fix, updates safely and checks checkout, login and forms afterwards, within 24–48 hours, no meetings. One-time $99. Queue an emergency fix → · Want this handled every month? WordPress care plan →

How to Check if Your Site is Exposed

Determining if your WordPress site is vulnerable involves checking your Kirki plugin version and potentially reviewing server logs for suspicious activity.

Version Check

The most straightforward method is to check the installed version of the Kirki plugin.

1. Via WordPress Dashboard:

   • Log in to your WordPress admin area.
   • Navigate to "Plugins" > "Installed Plugins."
   • Locate the "Kirki" plugin in the list.
   • Check the version number displayed. If it is 6.2.5 or lower, your site is vulnerable.

2. Via WP-CLI:

   • If you have SSH access to your server and WP-CLI installed, you can run the following command in your WordPress root directory:

     wp plugin list --fields=name,version --format=table | grep kirki
     

   • This will display the Kirki plugin and its installed version.

Log Review

While version checking is primary, reviewing server or WordPress debug logs might reveal signs of attempted or successful exploitation. Look for unusual AJAX requests to admin-ajax.php associated with Kirki, or unexpected changes to user roles or passwords. However, identifying exploitation through logs can be complex and may require expertise.

Immediate Mitigation if You Cannot Update Today

If, for any reason, you cannot immediately update the Kirki plugin to a patched version, several immediate mitigation steps can help reduce your exposure. These are temporary measures and should not replace a timely update.

1. Disable the Plugin: The most effective immediate mitigation is to deactivate and disable the Kirki plugin entirely. This will, however, impact any theme customizations that rely on Kirki. If you are using a theme that heavily depends on Kirki, you may need to carefully consider the trade-offs.

   • Via WordPress Dashboard: Go to "Plugins" > "Installed Plugins," find Kirki, and click "Deactivate."
   • Via WP-CLI: Run wp plugin deactivate kirki.
   • Via FTP/File Manager: Navigate to the wp-content/plugins/ directory and rename the kirki folder to something else (e.g., kirki_disabled).

2. Restrict Access to admin-ajax.php (Advanced): For highly technical users, you could consider implementing server-level rules (e.g., via .htaccess or Nginx configuration) to restrict access to admin-ajax.php for users who do not have a legitimate need to interact with it extensively. This is a complex measure that carries a high risk of breaking legitimate site functionality and is generally not recommended for most users.

3. Implement a Web Application Firewall (WAF): If you have a WAF configured, ensure its rulesets are up-to-date. Some WAFs may have rules that can detect and block exploitation attempts targeting known vulnerabilities like CVE-2026-75891.

How to Update Safely

Updating any plugin on a live WordPress site carries inherent risks. To ensure a smooth transition and prevent unintended consequences, it's crucial to follow a safe update process.

1. Backup Your Site: Before performing any update, always create a complete backup of your WordPress files and database. This backup serves as a recovery point in case anything goes wrong. Use a reliable backup plugin or your hosting provider's backup tools.

2. Use a Staging Environment: The safest way to update is on a staging site. A staging site is a clone of your live website where you can test updates and changes without affecting your production environment.

   • Many hosting providers offer one-click staging environment creation.
   • Alternatively, you can manually create a staging copy of your site on a subdomain or a separate directory.

3. Perform the Update on Staging:

   • On your staging site, navigate to "Plugins" > "Installed Plugins."
   • Update the Kirki plugin to the latest available version.
   • Check the Changelog: Review the Kirki plugin's changelog (available on wordpress.org or via the plugin's page in your dashboard) to understand what changes were made in the update.

4. Test Thoroughly: After updating on staging, rigorously test your website:

   • Frontend: Browse various pages, check layouts, and ensure all elements display correctly.
   • Backend: Test the WordPress admin area, especially features related to theme customization or any areas that might interact with Kirki.
   • User Interactions: Test essential functionalities like user registration, login, password resets, contact forms, and e-commerce checkout processes (if applicable).
   • Editor: If you use the Block Editor or Classic Editor, test creating and editing posts/pages.

5. Deploy to Live: Once you are confident that the update has not introduced any issues on your staging site, you can proceed with updating the Kirki plugin on your live website. Follow the same backup and testing procedures, though the intensity of testing may be slightly reduced if staging was very thorough.

Short Checklist

To ensure your site is protected against CVE-2026-75891:

• Verify the Kirki plugin version installed on your WordPress site.
• Ensure the Kirki plugin is updated to the latest version available.
• If immediate update is not possible, consider deactivating the Kirki plugin as a temporary measure.
• Always perform backups before updating any plugin.
• Test plugin updates on a staging environment before deploying to the live site.
• Review WordPress and server logs for any suspicious activity related to admin-ajax.php or user management.
• Consult the official NVD entry for CVE-2026-75891 for the latest information.
• Check the Kirki plugin's official website or WordPress.org page for any specific advisories or recommended actions.