Kirki WordPress Plugin CVE-2026-75891

Requires the Kirki (Freeform Page Builder, Website Builder & Customizer) plugin, version ≤6.2.5, installed and active, plus an authenticated account at Subscriber level or above (CVSS PR:L) - no higher privilege and no user interaction (UI:N) are needed. The specific trigger is a request to the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher, which deserializes untrusted input without a capability check; successful privilege escalation also depends on the presence of the described POP chain in the running code. The main limiting factor is the Subscriber-account requirement: sites that allow open user registration are effectively exposed to any visitor, while sites that disable self-registration require the attacker to first obtain a low-privilege account.

Signals are consistent and point to a genuine but non-emergency priority. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a high-impact flaw: network-reachable, low attack complexity, only Subscriber-level privileges required, no user interaction, with full confidentiality, integrity and availability impact because the POP chain lets an attacker overwrite an administrator password and take over the site. Against that, the exploitation signals are modest: EPSS is only 0.30% (23rd percentile), the CVE is not listed in CISA KEV, and no public exploit or PoC reference is present in the supplied data - so the low EPSS and absence of exploitation evidence temper the high base score rather than contradict it. The vuln.today Decision label is 'this_week', which aligns with the SSVC-style reading of a high-impact, easily-automatable but not-yet-exploited bug: patch promptly, not as a fire drill. The one real-world amplifier to weigh is PR:L - exploitation needs only a Subscriber account, so any WordPress site running Kirki ≤6.2.5 with open user registration effectively lowers the bar to near-unauthenticated; sites that disable self-registration raise it meaningfully. No signals are missing in a way that changes the verdict, though the exact fixed version is not stated in the input (only a patch changeset reference).

An attacker registers or obtains a low-privilege Subscriber account on a WordPress site running Kirki ≤6.2.5, then sends a crafted AJAX request to the 'get-single-symbol' branch of the kirki_post_apis() dispatcher carrying a serialized PHP object. Because the branch lacks a capability check and deserializes the untrusted input, the payload instantiates an object that drives the available POP chain to overwrite an administrator's password, yielding full administrative access. No public exploit code is identified in the available data, and no user interaction is required.