EUVD-2026-110629

The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirkipostapis AJAX dispatcher due to a missing capability check. This make...