CVE-2026-8073

Published: May 19, 2026Modified: Jul 24, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: security@wordfence.com (Secondary)

Description

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function in all versions up to, and including, 6.0.6. This makes it possible for unauthenticated attackers to read and delete arbitrary files limited in the WordPress uploads base directory.

Related CWEs

CWE-23

Relative Path Traversal

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

References (3)

https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.1/includes/API.php#L60

Source: security@wordfence.com

https://plugins.trac.wordpress.org/changeset/3535640/kirki/trunk/includes/API.php

Source: security@wordfence.com

https://www.wordfence.com/threat-intel/vulnerabilities/id/b073edd0-3f40-423e-976e-996b29caf66e?source=cve

Source: security@wordfence.com

Timeline

No history available yet.