Threats tagged 'ghsa-ppv3-rhmr-8mqr'

The Kirki WordPress plugin up to version 6.2.5 contains a privilege escalation vulnerability via PHP Object Injection. This occurs due to deserialization of untrusted input in an AJAX dispatcher without proper capability checks, allowing authenticated users with Subscriber-level access or higher to inject PHP objects. Exploitation can lead to overwriting an administrator's password and gaining full administrative control.