EUVD-2026-51745
GHSA-w4j2-hwpx-q9c7
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
PR:H reflects custom-level auth requirement; S:C and full C/I/A:H reflect arbitrary file write enabling RCE that escapes the WordPress application boundary.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, and including, 6.0.13 via the extract_zip_file function. This makes it possible for authenticated attackers, with custom-level access and above, to write arbitrary files on the server, which can allow for remote code execution. The install_app, update_app, and get_kirki_template_from_zip code paths accept a user-supplied app src value to construct the download URL, and no sanitization is applied to prevent a crafted ZIP from being fetched and extracted with path-traversing entry names that escape the intended destination directory.
AnalysisAI
Zip Slip path traversal in the Kirki WordPress plugin (all versions through 6.0.13) enables authenticated attackers with custom-level access or above to write arbitrary files anywhere on the server, leading to remote code execution. The root cause is the plugin's app installation and update workflows - install_app, update_app, and get_kirki_template_from_zip - which fetch a user-supplied external ZIP URL via an unsanitized app src parameter and extract its contents without validating entry names for path-traversal sequences. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the write-to-RCE escalation path is mechanically straightforward once the authentication bar is cleared.
Technical ContextAI
The vulnerability (CWE-22, Path Traversal) is a classic Zip Slip: when a ZIP archive is extracted, its entry names are used to reconstruct destination file paths, but if those names contain sequences such as '../../', extraction can escape the intended target directory. The affected plugin - cpe:2.3:a:themeum:kirki_-_freeform_page_builder,_website_builder_&_customizer:*:*:*:*:*:*:*:* - implements app management features (install, update, template import) that fetch ZIP files from an attacker-controllable URL. The extract_zip_file function in app/Supports/FileHandler.php (line 90) performs extraction without canonicalizing or rejecting entry names that traverse outside the designated destination. The three vulnerable entry points - AppsService.php (lines 113, 186), AppsController.php (line 27), Ajax/Apps.php (line 176), and routes/api.php (line 77) - share the flaw because all pass the unsanitized app src value downstream to the same extraction routine. The result is that any file writable by the PHP/web server process (typically the entire WordPress install tree) becomes a write target.
RemediationAI
Upstream fix available (WordPress plugin repository changeset 3617070 at https://plugins.trac.wordpress.org/changeset?reponame=&old=3617070%40kirki&new=3617070%40kirki); the exact patched release version number is not independently confirmed from the available data - update to the latest available Kirki release in the WordPress plugin directory and verify the version exceeds 6.0.13. As a compensating control until patching is possible, restrict the WordPress custom roles that can access the app installation and update functionality by removing the relevant capabilities from non-administrator roles; this eliminates the attack surface for non-admin users entirely. Additionally, web application firewall rules that block requests containing ZIP-related path traversal sequences (../ encoded variants) to the plugin's API endpoints can reduce exposure. Neither control is a substitute for patching, as a determined administrator-level attacker bypasses both.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today