Kirki Page Builder CVE-2026-15457

Exploitation requires an active authenticated WordPress session with editor-level access or higher (confirmed by CVSS PR:H). The Kirki plugin must be installed and active on the target site at version 6.0.13 or earlier. The vulnerable attack surface is the plugin's font management API, specifically endpoints registered in api.php that pass the 'family' parameter through FontService.php without path boundary enforcement. Exploitation is limited by: (1) mandatory editor-level authentication - unauthenticated users, subscribers, and contributors cannot reach the vulnerable code path; (2) the filesystem impact is bounded by the operating system permissions of the web server process, so server hardening (running as a low-privilege user with restricted directory access) limits the directories reachable for deletion; (3) the site must have Kirki actively enabled, not merely installed.

The NVD-assigned CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, score 4.9) contains a material inconsistency: C:H implies high confidentiality impact, yet the CVE description exclusively describes directory deletion resulting in data loss and availability disruption - not information disclosure. A corrected vector reflecting the actual described impact (C:N/I:H/A:H) would score approximately 6.5. This discrepancy should be verified with Wordfence or Themeum before using the NVD score for prioritization. The PR:H requirement - WordPress editor role - substantially constrains the real-world attack surface: exploitation is limited to sites where untrusted or compromised accounts hold editor privileges. No EPSS data was supplied, no CISA KEV listing exists, and no public proof-of-concept was identified, placing this in a lower real-world exploitation-probability tier despite the potentially severe consequence of irreversible directory deletion.

An attacker who holds or has compromised an editor-level WordPress account on a site running Kirki 6.0.13 or earlier sends a crafted POST request to the plugin's font management API endpoint, supplying a path traversal sequence (e.g., '../../wp-content/uploads') in the 'family' parameter. FontService.php resolves the traversed path and deletes the targeted directory without validation, permanently destroying the contents. Repeated targeting of critical directories - such as the uploads folder, active theme, or plugin directories - can render the WordPress installation inoperable or destroy all user-uploaded media.