Kirki flaw lets subscribers take over admin accounts

Q: What if I cannot update Kirki right away?

Close registration by unticking Anyone can register under Settings > General until you can update. That only lowers the risk, because accounts that already exist stay. If you do not use Kirki for anything, deactivate and delete it, but check on a copy first that the site looks the same without it.

Q: How can I tell whether someone logged in as an administrator through Kirki?

List the administrators and the newest accounts with wp user list in cPanel's Terminal and look for an administrator you do not recognise. The attack overwrites an existing administrator's password, so an administrator who suddenly cannot log in with their password is a warning sign too. If someone has already logged in as an administrator, a new password alone is not enough, since they may have created another account or left a backdoor. Change every administrator's password, end their sessions with Log Out Everywhere and clean the site as a hacked one.

# TagsSecurityWordPress

The WPhost team27 Oct 20269 min read

On 26 October 2026 Wordfence disclosed a vulnerability in Kirki, Themeum's plugin for theme settings and visual page building (CVE-2026-75891), and on 27 October the record appeared in the NVD. It is a privilege escalation flaw. Anyone with an account on the site, even with the lowest role, Subscriber, can change an administrator's password and log in as that administrator. All versions up to and including 6.2.5 are affected, and the CVSS score is 8.8 ("high"). According to wordpress.org, Kirki has more than 500,000 active installations.

The fix is in version 6.3.0, released on 2 September, and the current version is 6.4.0, released on 13 October. If the plugin updates automatically, your site is probably protected already. Check anyway whether your theme carries its own copy of Kirki, because that copy does not update with the plugin.

How the privilege escalation works

Kirki's editor sends requests to the site in the background (AJAX). According to the CVE record, one of them, get-single-symbol, does not check whether the user is allowed to call it. The plugin takes data from the request and turns it back into PHP objects without validating it, which is known as PHP object injection. The site's code contains a suitable chain of classes (a POP chain), and with it the attacker overwrites an administrator's password and gets into the dashboard with full rights.

The attack needs nothing from the administrator, no click and no opened email. A Subscriber account is enough, and anyone can create one if registration on the site is open and new users get that role. The CVSS score guide explains what a score of 8.8 means.

Wordfence notified Themeum on 18 August, and the fix shipped two weeks later. As of 27 October the vulnerability is not in CISA's catalogue of vulnerabilities exploited in attacks, and none of the sources below reports any attacks. The record is public now, though, and it names the vulnerable request, so that may change quickly.

Why Kirki may be on your site without you choosing it

Up to version 5, Kirki was a framework for the Customizer, the Appearance > Customize screen where a theme shows its settings for colours, fonts and layout. Some themes require or recommend it on installation, so the plugin may be on your site only because of the theme.

With version 6.0.0 Kirki became a visual page builder, and the Customizer part stayed. A site that kept the plugin updated received the builder along with the code that contains this vulnerability. The last release in the 5 series (5.2.3) does not contain that code. Even so, the CVE record lists every version up to 6.2.5, and the fix exists only in 6.3.0 and later, so update a site that is still on 5.x too.

Some themes and plugins ship Kirki inside their own files, as the notes for version 6.0.3 also mention. Such a copy does not appear in the plugin list and only updates when you update the theme or plugin that contains it.

Is your site affected?

It is if Kirki is on version 6.2.5 or older. You can see the version under Plugins > Installed Plugins, on Kirki's row. In cPanel's Terminal, the first command below shows the plugin's version. The second searches the themes and plugins for files with the kirki_post_apis request handler, where the vulnerability sits, and the third shows the version of every copy of Kirki. The WP-CLI guide explains how to work with WP-CLI.

Bash

# cPanel > Terminal, in the site's folder
# Read-only. The Kirki version and its copies in themes and plugins.
wp plugin list --fields=name,status,version \
  --skip-plugins --skip-themes | grep -i kirki
grep -rl --include="*.php" "kirki_post_apis" \
  wp-content/themes wp-content/plugins
grep -r --include="kirki.php" "Version:" \
  wp-content/themes wp-content/plugins

If the plugin is installed, the second command shows at least wp-content/plugins/kirki/includes/Ajax.php. A line that starts with wp-content/themes/ or with another plugin's folder means a bundled copy of Kirki 6. The third command should show 6.3.0 or later for every copy. If the copy in your theme is older, update the theme and ask its author which Kirki version it contains.

What to do

Back up the files and the database, as described in the backup guide.
Update Kirki to 6.4.0 under Plugins > Installed Plugins with the Update Now button. This vulnerability was fixed in 6.3.0, but according to WPScan 6.4.0 fixes two more, one of which lets a logged-out visitor read users' data.
If the site is still on 5.x, try the update on a staging copy first. Version 6.0.0 rebuilt the plugin from the ground up, and Themeum recommends a backup before it.
If a copy of Kirki is bundled in your theme, update the theme and check the version again.
If you do not use Kirki for anything, deactivate and delete it. Code that is not on the site cannot be attacked. Some themes keep their settings through Kirki, though, so check on a copy first that the site looks the same without it.
If you cannot update right away, close registration until you can by unticking Anyone can register under Settings > General. That only lowers the risk, because accounts that already exist stay.

If your site allows registrations

The more accounts a site has, the more people can use this flaw. Open registration, WooCommerce customer accounts, a forum or a membership area all mean that anyone can have an account. According to the WooCommerce documentation, customers get the Customer role when they register at checkout, and that role has limited access similar to a Subscriber. Assume a customer account is enough for the attack.

The next commands check registration and users, and they are read-only as well.

Bash

# cPanel > Terminal, in the site's folder
# Read-only. Registration, the default role,
# the administrators and the newest users.
wp option get users_can_register --skip-plugins --skip-themes
wp option get default_role --skip-plugins --skip-themes
wp user list --role=administrator \
  --fields=ID,user_login,user_email,user_registered \
  --skip-plugins --skip-themes
wp user list --orderby=registered --order=DESC --number=20 \
  --fields=ID,user_login,user_email,roles,user_registered \
  --skip-plugins --skip-themes

If the first command returns 1, anyone can register, and the second shows the role they get. The third lists the administrators and the fourth the 20 newest accounts. Look for an administrator you do not recognise. The attack overwrites an existing administrator's password, so an administrator who suddenly cannot log in with their password is a warning sign too.

What we do

With vulnerability (CVE) monitoring we match the plugins, theme and WordPress on your site against the vulnerability (CVE) databases every day. As soon as a vulnerability appears in something you use, we send you an alert, and we try the update on a copy in staging first. If the checks above turn up an unfamiliar administrator, with hacked site cleanup we remove the malicious code and the backdoors. We do both for your site wherever it is hosted.

Frequently asked questions

What is CVE-2026-75891 in Kirki?

A privilege escalation flaw in Kirki, Themeum's plugin for theme settings and visual page building, disclosed by Wordfence on 26 October 2026. Anyone with an account on the site, even with the lowest role, Subscriber, can change an administrator's password and log in as that administrator. All versions up to and including 6.2.5 are affected, and the CVSS score is 8.8, "high".

Which Kirki version fixes the vulnerability?

Kirki 6.3.0 of 2 September 2026 fixes CVE-2026-75891, and the current version is 6.4.0 of 13 October. Update to 6.4.0, because according to WPScan it fixes two more vulnerabilities, one of which lets a logged-out visitor read users' data.

How did Kirki end up on my site?

Up to version 5, Kirki was a framework for the Customizer, the Appearance > Customize screen where a theme shows its colour, font and layout settings. Some themes require or recommend it on installation, so the plugin may be there only because of the theme. With version 6.0.0 Kirki became a visual page builder, and sites that kept it updated received the code with the vulnerability too.

Is my site affected if Kirki is bundled in the theme?

Yes, if the bundled copy is Kirki 6 and older than 6.3.0. Such a copy does not appear in the plugin list and only updates when you update the theme or plugin that contains it. In cPanel's Terminal, grep -r --include="kirki.php" "Version:" wp-content/themes wp-content/plugins shows the version of every copy of Kirki.

Is a site on Kirki 5.x affected?

The last release in the 5 series (5.2.3) does not contain the vulnerable code. The CVE record lists every version up to 6.2.5, though, and the fix exists only in 6.3.0 and later, so update a site still on 5.x as well. Try the update on a staging copy first, because version 6.0.0 rebuilt the plugin from the ground up and Themeum recommends a backup before it.

Is Kirki a risk for a WooCommerce store?

The more accounts a site has, the more people can use the Kirki flaw. According to the WooCommerce documentation, customers who register at checkout get the Customer role, with limited access similar to a Subscriber. Assume a customer account is enough for the attack.

What if I cannot update Kirki right away?

Close registration by unticking Anyone can register under Settings > General until you can update. That only lowers the risk, because accounts that already exist stay. If you do not use Kirki for anything, deactivate and delete it, but check on a copy first that the site looks the same without it.

How can I tell whether someone logged in as an administrator through Kirki?

List the administrators and the newest accounts with wp user list in cPanel's Terminal and look for an administrator you do not recognise. The attack overwrites an existing administrator's password, so an administrator who suddenly cannot log in with their password is a warning sign too. If someone has already logged in as an administrator, a new password alone is not enough, since they may have created another account or left a backdoor. Change every administrator's password, end their sessions with Log Out Everywhere and clean the site as a hacked one.

Sources