Privilege Escalation Attacks Hit Kirki and Burst Statistics WordPress Plugins
Threat actors are actively exploiting flaws in two widely-used WordPress plugins to grab admin access and seize site control.
Two WordPress plugins — Kirki, a customizer framework with millions of installations, and Burst Statistics, an analytics tool — are under active exploitation. Attackers are using vulnerabilities in both to escalate privileges and take over affected sites.
Privilege escalation via WordPress plugins is not a new genre. The mechanics here fit a pattern the WordPress security community has tracked for years: a flawed permission check (or none at all) on a sensitive endpoint, letting an unauthenticated or low-privilege user write themselves into an admin role. Classic broken access control. Different wrapper, same skeleton.
What makes this worth watching is the pairing. Two separate plugins, exploited in the same window, suggests either opportunistic scanning across a broad plugin list or a coordinated campaign targeting sites running popular third-party tooling. Neither conclusion is comforting.
Kirki's install base is substantial. Themes that rely on it for options panels tend to ship it silently, meaning site owners may not even know it's present. Burst Statistics has grown quickly as a GDPR-friendly Google Analytics alternative. Both represent the kind of quietly-ubiquitous software that sits in the long tail of a WordPress installation and rarely gets the patching attention it deserves.
The immediate remediation path is straightforward: update both plugins to their latest versions immediately, audit admin user lists for accounts you don't recognize, and review authentication logs for anomalous role changes. If you run a managed WordPress fleet, this is a good moment to confirm your plugin auto-update policy actually covers third-party tools and not just WordPress core.
For defenders thinking about detection, look for unexpected user_role changes in your database audit logs and any REST API calls touching user management endpoints that originate outside your normal traffic patterns. A sudden new administrator account on a site that hasn't been touched in weeks is a bad sign regardless of which plugin opened the door.
The broader lesson — and it keeps needing to be said — is that the WordPress plugin ecosystem is a perennial attack surface precisely because the barrier to publishing a plugin is low and the update adoption curve is slow. Keeping an inventory of what's installed and setting aggressive update cadences is dull work. It is also the work.
