EUVD-2026-59928
GHSA-4vm7-68xq-qf98
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain WordPress editor-level credentials
-
DeliverySend crafted AJAX request to ExportImport handler with traversal-embedded 'data' parameter
-
ExploitBypass flawed strpos() path guard
-
ExecutionServer reads and returns arbitrary file contents
-
PersistExtract wp-config.php database credentials and secret keys
-
ImpactEscalate to full database or site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress session with at minimum editor-level role, as confirmed by the CVSS PR:H metric and the capability check enforced in Ajax.php at line 349. The attacker must hold valid credentials for an editor, administrator, or equivalent account on the target installation. No special server configuration or non-default WordPress setting is required beyond having the Kirki plugin installed and active - the vulnerable AJAX endpoint is registered by default upon plugin activation. The bypass specifically requires crafting a path that includes the WordPress uploads directory base path (e.g., /wp-content/uploads/) as a substring while embedding ../ sequences to traverse outside that directory. Limiting factors are the editor-level credential prerequisite, which restricts exploitation to insider threats, account compromise scenarios, or environments where editor self-registration is enabled; unauthenticated or subscriber-level attackers cannot reach the vulnerable handler. |
| Impact | The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N accurately captures the attack surface: the endpoint is network-reachable with low complexity, but exploitation is strictly gated by editor-level WordPress credentials, significantly narrowing the realistic attacker population to insiders, compromised accounts, or sites with open editor registration. EPSS data was not included in the available intelligence, limiting probabilistic exploitation forecasting. No CISA KEV listing exists and no public proof-of-concept exploit code has been identified at time of analysis, making this a lower-urgency item from a threat-landscape perspective. Despite the Medium CVSS score, the confidentiality impact is High in practice because the most accessible target - wp-config.php - contains database credentials and WordPress secret keys that enable full secondary compromise; even a mid-sized municipal IT team in boleslawiec operating a WordPress portal with untrusted or loosely managed editor accounts should treat this as a meaningful internal threat rather than dismissing it on score alone. The primary risk driver is insider or compromised-account abuse, not opportunistic automated scanning, since the PR:H requirement bars unauthenticated exploitation. |
| Exploit ScenarioDerived | An authenticated WordPress user with editor-level access sends a crafted AJAX request to the Kirki ExportImport endpoint, supplying a 'data' parameter value such as /wp-content/uploads/../../wp-config.php. The flawed strpos() guard accepts the path because the uploads base path appears as a substring, and the plugin reads and returns the file contents, exposing database credentials and WordPress secret keys. No public proof-of-concept exploit code has been confirmed at time of analysis, but the bypass technique is straightforward for any attacker familiar with PHP path-validation anti-patterns. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 16, 2026
Directory traversal in the Kirki WordPress plugin (all versions through 6.1.1) allows authenticated attackers with editor-level access to read arbitrary files on the server by exploiting a flawed strpos()-based path validation guard in the plugin's AJAX ExportImport handler. By crafting a 'data' parameter value that embeds the uploads directory path as a substring while appending directory traversal sequences, an attacker can escape the intended upload directory restriction and retrieve sensitive files such as wp-config.php containing database credentials and secret keys. No active exploitation has been confirmed and no CISA KEV listing exists; the CVSS score of 4.9 (Medium) reflects the high privilege requirement, though the confidentiality impact is rated High due to the severity of files that can be exposed as a precursor to full site compromise.
RemediationAI
Site owners should update the Kirki plugin to a version released after 6.1.1 as soon as a patched release is available; a fix commit is referenced in the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3629933%40kirki&new=3629933%40kirki, but the exact patched release version has not been independently confirmed from the available data and should be verified against the official WordPress plugin directory or Themeum's changelog prior to deployment. As an interim compensating control, restrict WordPress editor-role assignments to the minimum number of trusted users, since exploitation requires at least editor-level credentials. If the import/export functionality is not actively used, deactivating the plugin eliminates the attack surface entirely without side effects for sites not relying on that feature. Additionally, ensure wp-config.php and other sensitive configuration files carry filesystem permissions that prevent reads by the web server process where the hosting environment allows it, though this does not fully remediate the flaw and is a defense-in-depth measure only.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Kirki plugin (CPE: cpe:2.3:a:themeum:kirki_-_freeform_page_builder,_website_builder_&_customizer:*:*:*:*:*:*:*:*) is a PHP-based WordPress customization framework that provides AJAX-driven export and import functionality implemented in includes/Ajax/ExportImport.php. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), arising from the use of PHP's strpos() function to validate that a supplied file path falls within the WordPress uploads directory. Because strpos() performs substring matching rather than strict prefix-anchored validation, a path value such as /wp-content/uploads/../../wp-config.php satisfies the check - the uploads base path appears as a substring - while the embedded ../ traversal sequences cause the filesystem to resolve the path outside the permitted directory. The vulnerable 'data' parameter is processed at multiple code points in ExportImport.php (lines 26, 52, 182, and 186 per plugin repository references) and the AJAX dispatcher in Ajax.php (line 349) enforces a WordPress capability check requiring at minimum editor-level role before invoking the handler.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Editor-level WordPress authentication is required to reach the handler (PR:H); exploitation yields file read only, so integrity and availability are unaffected (I:N/A:N).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The intended strpos()-based guard against leaving the uploads directory is bypassed by crafting a URL that includes the uploads base path as a substring while embedding directory traversal sequences, such as /wp-content/uploads/../../wp-config.php.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB