Authenticated attackers can exploit a PHP Object Injection vulnerability in the Kirki plugin for WordPress to overwrite an administrator's password and gain…
Affected component: Kirki – Freeform Page Builder, Website Builder & Customizer (plugin)
Fixed in: 6.3.0
PowerSEC coverage: PowerSEC detects the affected versions on every plan, and has since October 29, 2026. No PowerSEC firewall rule blocks this attack. Update to 6.3.0 or later to remove the vulnerability.
Full advisory, including detection steps and remediation: https://powersec.io/vulnerability/cve-2026-75891