Kirki WordPress Plugin EUVD-2026-30976

No special conditions - remote unauthenticated exploitation against default configurations of WordPress sites running the Kirki plugin version 6.0.6 or earlier; the vulnerable 'downloadZIP' function is reachable without login or user interaction. The only material limit on impact (not on exploitability) is that file read and deletion are constrained to paths reachable from the WordPress uploads base directory, so OS-level files outside wp-content/uploads and files protected by filesystem permissions are not directly affected; the attacker must also be able to reach the WordPress HTTP(S) endpoint, so sites behind IP allowlists or VPN-only access have reduced exposure.

The CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N) reflects a network-reachable, low-complexity, unauthenticated attack with high confidentiality impact but, per the official vector, no integrity or availability impact recorded - a notable inconsistency, since the description explicitly confirms arbitrary file deletion, which should logically map to I:H or A:H. Defenders should therefore treat this as higher than the headline score suggests when assessing impact on site availability (deleted uploads can break media libraries, themes, and child-plugin assets). No EPSS, KEV, or SSVC data was provided; the vulnerability is not currently listed as actively exploited, and no public exploit identified at time of analysis, but WordPress plugins of this popularity historically see rapid mass-exploitation once a PoC surfaces, especially given the unauthenticated nature.

An unauthenticated attacker on the internet sends a crafted HTTP request to the Kirki 'downloadZIP' endpoint on a vulnerable WordPress site, supplying a manipulated file-path parameter that uses relative traversal to reference files inside wp-content/uploads (for example, backup archives, exported user data, or media assets). The attacker first downloads the file contents and then triggers deletion, defacing the media library or destroying site backups stored in uploads. No public exploit identified at time of analysis, but the low attack complexity and no-authentication requirement make weaponization straightforward once researchers publish details.