CVE WATCH / VULNERABILITY DETAIL
CVE-2026-75891
HIGHCVSS 8.8NVD feed
Published 27 October 2026 · tracked since 28 October 2026
Description
The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher due to a missing capability check. This mak
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-117602 HIGH 8.4
- CVE-2026-117603 MEDIUM 4.3
- CVE-2026-117566 MEDIUM 5.3
- CVE-2026-117564 CRITICAL 9.8
- CVE-2026-117558 HIGH 7.8
- CVE-2026-117559 HIGH 7.8
- CVE-2026-117554 MEDIUM 4.3
- CVE-2026-65119 HIGH 8.4
- CVE-2026-117499 LOW 3.7
- CVE-2026-10752 MEDIUM 4.8