What is the CVSS score of EUVD-2026-49231?

EUVD-2026-49231 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Kirki EUVD-2026-49231

| CVE-2026-65436 MEDIUM

Path Traversal (CWE-22)

2026-07-27 Patchstack

GHSA-q7jw-4655-mjq2

WordPress Path Traversal Wordpress Plugin Kirki

6.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Editor-only reachability sets PR:H; arbitrary deletion destroys data (I:L) and can down the site (A:H); scope kept U as the action stays within the WordPress host's authority.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 15:06 vuln.today

CVE Published

Jul 27, 2026 - 13:59 cve.org

MEDIUM 6.8

DescriptionCVE.org

Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.

AnalysisAI

Arbitrary file deletion in the Kirki WordPress plugin (versions up to and including 6.0.13) allows an authenticated user with Editor-level privileges to delete files on the server via a path traversal flaw (CWE-22). The vulnerability is not exploitable by unauthenticated attackers, requires no victim interaction, and has no public exploit identified at time of analysis (CISA KEV: not listed, EPSS 0.33%). The impact is limited to availability, as successful exploitation can remove files but does not expose data or enable code execution, making this a moderate-priority issue.

Technical ContextAI

The flaw is a path traversal (CWE-22) in the Kirki plugin, a theme customizer framework for WordPress that is bundled with or used by many themes. The plugin's file handling logic fails to properly validate file paths, allowing an authenticated user at the Editor role (or a compromised higher-privileged account) to supply a crafted path that results in the deletion of arbitrary files on the underlying server. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, and no user interaction; the independent assessment reassessed scope as unchanged (S:U) with low integrity (I:L) and high availability (A:H) impact, confirming the primary risk is disruption of site availability through file removal. The CPE cpe:2.3:a:themeum:kirki:*:*:*:*:*:*:*:* and tags (WordPress, Path Traversal, WordPress Plugin) identify the affected component as the Kirki plugin developed by Themeum.

RemediationAI

No vendor-released patch is identified in the available data. Until an official fix is released, consider disabling or uninstalling the Kirki plugin if your theme does not require it, though this may break theme customizer functionality. Alternatively, restrict the Editor role by removing capabilities or reassigning users to lower-privileged roles, accepting reduced editorial workflow. Enforce strong authentication such as two-factor authentication for all users with Editor or higher privileges to prevent account compromise, since exploitation requires authenticated access. Monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/kirki/vulnerability/wordpress-kirki-plugin-6-0-13-arbitrary-file-deletion-vulnerability?_s_id=cve) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-65436) for updates and apply the patch as soon as it becomes available. As a temporary measure, a WAF rule can block path traversal patterns in requests to the plugin's endpoints, but this may not cover all vectors and could cause false positives. Note that limiting privileged accounts significantly reduces risk.