CVE-2026-75891: themeum Kirki – Freeform Page Builder, Website Builder & Customizer (High, CVSS 8.8)
- CVSS
- 8.8 High (v3.1)
- EPSS
- 0.3% chance of exploitation in the next 30 days (higher than 23.1% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- None reported in public exploit databases
- Weakness
- CWE-502
- Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Published
- Oct 27, 2026
What it is
The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher due to a missing capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to overwrite an administrator's password and gain administrative access.
Description from the National Vulnerability Database.
What to do
Check whether you run themeum Kirki – Freeform Page Builder, Website Builder & Customizer, then apply the vendor’s fix or mitigation from the advisories below.
Sources: NVD, FIRST EPSS, CISA KEV, and public exploit databases (availability only). ThreatRoundup reports whether public exploit code exists but never links to it: fake proof-of-concepts that infect security researchers are common. This page updates automatically.