CVE-2026-75891 - Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint
CVE ID :CVE-2026-75891 Published : Oct. 27, 2026, 7:16 a.m. | 1 hour, 7 minutes ago Description :The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the...