What is the CVSS score of CVE-2026-8073?

CVE-2026-8073 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Kirki WordPress Plugin are affected by CVE-2026-8073?

The Kirki page builder plugin for WordPress (versions 6.0.6 and earlier) contains a vulnerability allowing unauthenticated remote attackers to read and delete files from the WordPress uploads…

How to fix or mitigate CVE-2026-8073?

Within 24 hours: Identify all WordPress installations running Kirki plugin version 6.0.6 or earlier and document business criticality. Within 7 days: Deactivate and remove the affected plugin from all systems; implement compensating controls below if the plugin is business-critical. Within 30 days: Monitor Kirki project for security patch release; if patch is available, test and reinstall; if not, plan migration to alternative page builder plugins.

Kirki WordPress Plugin CVE-2026-8073

EUVD-2026-30976 HIGH

Relative Path Traversal (CWE-23)

2026-05-19 Wordfence

GHSA-r2f5-qhhx-h354

WordPress Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 19, 2026 - 19:30 vuln.today

DescriptionCVE.org

The Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function in all versions up to, and including, 6.0.6. This makes it possible for unauthenticated attackers to read and delete arbitrary files limited in the WordPress uploads base directory.

AnalysisAI

Arbitrary file read and deletion in the Kirki - Freeform Page Builder plugin for WordPress (versions through 6.0.6) allows unauthenticated remote attackers to read and delete files within the WordPress uploads base directory by abusing the 'downloadZIP' function. The flaw stems from insufficient path validation and a missing capability check, and was reported by Wordfence; no public exploit identified at time of analysis.

Technical ContextAI

Kirki is a popular WordPress customizer framework and page-builder plugin developed by Themeum. The vulnerable 'downloadZIP' function within includes/API.php is exposed without proper authorization (no current_user_can/capability check) and without sanitization of the requested file path, allowing relative path manipulation. This is a textbook CWE-23 (Relative Path Traversal) issue: user-supplied input is concatenated into a filesystem path used for both reading (zipping) and deleting files, with the WordPress uploads directory serving as the effective root, but with traversal possible within that scope.

RemediationAI

Upstream fix available (changeset 3535640 on the kirki trunk); released patched version not independently confirmed from the supplied data, so administrators should upgrade to the latest available Kirki release published after changeset 3535640 (any version greater than 6.0.6) via the WordPress plugin updater and verify the patched API.php is deployed. If immediate upgrade is not possible, compensating controls include deactivating the Kirki plugin entirely (trade-off: site customizer features and theme options may break), blocking unauthenticated requests to the plugin's REST/AJAX endpoints that reach the 'downloadZIP' handler at the web application firewall or via .htaccess/nginx rules (trade-off: may break legitimate customizer export functionality), and ensuring filesystem-level backups of wp-content/uploads exist so deleted files can be restored. Reference the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b073edd0-3f40-423e-976e-996b29caf66e for detection signatures.