Privilege Escalation Attacks Hit Kirki and Burst Statistics WordPress Plugins
Threat actors are actively exploiting flaws in two widely-used WordPress plugins to grab admin access and seize site control.
Key points
- Attackers are exploiting privilege-escalation flaws in both the Kirki customizer framework and the Burst Statistics analytics plugin.
- Both vulnerabilities follow a broken access control pattern: a flawed or missing permission check lets low-privilege or unauthenticated users write themselves into an admin role.
- Kirki ships silently inside many themes, so site owners may not know it is present.
- Remediation is plugin updates plus an immediate audit of admin user lists and authentication logs.
- Two popular plugins exploited in the same window suggests broad opportunistic scanning, at minimum.
What is actually happening here?
Broken access control: a flawed permission check on a sensitive endpoint lets an unauthenticated or low-privilege user claim an admin role. That is the skeleton inside both of these attacks. The wrapper is different plugins; the skeleton is the same one we flagged in the WP Maps Pro case on 1 June, where a critical bug was being weaponized to seed rogue administrators on live sites.
Kirki's install base is large and largely invisible: themes that rely on it for options panels tend to ship it without advertising the dependency, so site owners may not know it is present. Burst Statistics has grown as a GDPR-friendly analytics alternative and sits in a similar blind spot. Quietly ubiquitous software rarely gets the patching urgency it deserves.
Two separate plugins exploited in the same window points either to opportunistic scanning across a broad plugin list or a coordinated campaign against sites running popular third-party tooling. Neither reading is comforting.
Should you worry?
If you run WordPress, yes, but the fix is not complicated. Update both plugins to their latest versions now, check your admin user list for accounts you do not recognise, and review authentication logs for unexpected role changes. If you manage a fleet of WordPress sites, confirm your auto-update policy covers third-party plugins and not just core.
For detection, watch for user_role changes in database audit logs and REST API calls touching user management endpoints that originate outside normal traffic patterns. A new administrator account on a site that has not been touched in weeks is a bad sign regardless of which plugin opened the door.
Why does this keep happening?
The WordPress plugin ecosystem is a perennial attack surface because the barrier to publishing a plugin is low and update adoption is slow. Keeping an inventory of installed plugins and setting aggressive update cadences is dull, unglamorous work. It is also the work that stops this class of attack cold.
