What is the CVSS score of CVE-2026-15457?

CVE-2026-15457 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.8%.

Kirki Page Builder CVE-2026-15457

EUVD-2026-45131 MEDIUM

Path Traversal (CWE-22)

2026-07-17 Wordfence

GHSA-wpxg-qxjj-h86m

WordPress Path Traversal Wordpress Plugin Kirki Freeform Page Builder Website Builder Customizer Themeum

4.9

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Directory deletion impacts integrity and availability, not confidentiality; C:H in the NVD vector contradicts the described impact and is replaced with I:H/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 05:16 vuln.today

CVE Published

Jul 17, 2026 - 03:43 cve.org

MEDIUM 4.9

DescriptionCVE.org

The Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete arbitrary directories on the server, which can result in loss of data and availability.

AnalysisAI

Directory traversal via the unsanitized 'family' parameter in the Kirki plugin for WordPress (all versions up to and including 6.0.13) enables authenticated users holding editor-level access or above to delete arbitrary directories on the server filesystem, risking data loss and site unavailability. Reported by Wordfence, the flaw originates in insufficient path validation within FontService.php and GlobalDataController.php, which process the 'family' parameter without canonicalization or boundary enforcement. No public exploit code exists and no CISA KEV listing is present at time of analysis, but the potential for irreversible filesystem destruction makes this a meaningful risk on any WordPress site granting editor access to untrusted accounts.

Technical ContextAI

The Kirki plugin (CPE: cpe:2.3:a:themeum:kirki_-_freeform_page_builder,_website_builder_&_customizer:*:*:*:*:*:*:*:*) by Themeum is a WordPress page builder and theme customizer. The flaw is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal). The vulnerable 'family' parameter is ingested by FontService.php at line 157 and routed through the plugin's API layer defined in api.php (line 74) and GlobalDataController.php (line 105), with additional exposure in includes/Ajax/Media.php (line 996). Without path sanitization or canonicalization, an attacker-controlled value containing sequences such as '../../' causes the plugin to resolve and operate on directories outside the intended font-cache scope, ultimately invoking a delete operation on an arbitrary server path. The web server process's filesystem permissions define the blast radius.

RemediationAI

A code-level fix has been committed to the WordPress plugin repository as changeset 3608888 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3608888%40kirki&new=3608888%40kirki); however, a specific patched release version number is not confirmed from available data - update the Kirki plugin immediately when an update appears in the WordPress.org plugin dashboard, as the changeset indicates an upstream fix is ready. As an immediate compensating control, audit and restrict the WordPress editor role to fully trusted users only, since exploitation unconditionally requires editor-level authentication - revoking unnecessary elevated access eliminates the attack vector entirely without affecting site functionality. Additionally, deploying a Web Application Firewall rule that blocks path traversal sequences (e.g., '../', '%2e%2e%2f') in the plugin's 'family' API parameter provides a secondary barrier without disabling the plugin. Note that WAF rules may interfere with legitimate font-name inputs containing dots or slashes; test in a staging environment before production rollout.