EUVD-2026-49231
GHSA-q7jw-4655-mjq2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as Editor on WordPress
-
DeliverySend crafted request to Kirki file handler
-
ExploitSupply path-traversal sequence to target file
-
ExecutionPlugin deletes arbitrary file
-
ImpactSite disruption or forced reinstall
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress user at Editor role (or a compromised/higher-privileged account) on a site running the Kirki plugin version 6.0.13 or earlier; per the CVSS PR:H metric this is not remotely reachable by anonymous users. No user interaction by a victim is needed (UI:N). Exploitation is limited by that privilege prerequisite and by the plugin actually being installed and active - Kirki is a theme customizer framework, so the site must ship or enable it. Impact is availability-only (file deletion), with no direct confidentiality or code-execution primitive from the flaw itself. |
| Impact | This is a moderate, not critical, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H, base 6.8) shows a network-reachable, low-complexity flaw but one gated behind high privileges (PR:H) - per Patchstack's WordPress role mapping this corresponds to an authenticated Editor-level account, so exploitation presupposes a partially-trusted insider or a compromised Editor credential rather than an anonymous attacker. Signals are internally consistent and point away from urgency: EPSS is only 0.33% (25th percentile), SSVC records Exploitation:none, Automatable:no, Technical Impact:partial, there is no CISA KEV listing, and no public exploit was identified in the provided intelligence. The impact is confined to availability (C:N/I:N/A:H) - arbitrary deletion of files, which can break the site or, if sensitive files like wp-config.php are removed, force the site into a reinstall/takeover state (the likely justification for the S:C scope change). Net: a real but bounded issue whose privilege requirement and lack of exploitation evidence make it a routine patch rather than an emergency. |
| Exploit ScenarioDerived | An attacker who holds or has compromised a WordPress Editor account on a site running Kirki <= 6.0.13 submits a crafted request to the plugin's file-handling functionality, supplying a traversal path (CWE-22) to a file outside the intended directory. The plugin deletes the targeted file, allowing the actor to remove critical files (e.g., configuration or plugin files) and degrade or disable the site. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Arbitrary file deletion in the Kirki WordPress plugin (versions up to and including 6.0.13) allows an authenticated user with Editor-level privileges to delete files on the server via a path traversal flaw (CWE-22). The vulnerability is not exploitable by unauthenticated attackers, requires no victim interaction, and has no public exploit identified at time of analysis (CISA KEV: not listed, EPSS 0.33%). The impact is limited to availability, as successful exploitation can remove files but does not expose data or enable code execution, making this a moderate-priority issue.
RemediationAI
No vendor-released patch is identified in the available data. Until an official fix is released, consider disabling or uninstalling the Kirki plugin if your theme does not require it, though this may break theme customizer functionality. Alternatively, restrict the Editor role by removing capabilities or reassigning users to lower-privileged roles, accepting reduced editorial workflow. Enforce strong authentication such as two-factor authentication for all users with Editor or higher privileges to prevent account compromise, since exploitation requires authenticated access. Monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/kirki/vulnerability/wordpress-kirki-plugin-6-0-13-arbitrary-file-deletion-vulnerability?_s_id=cve) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-65436) for updates and apply the patch as soon as it becomes available. As a temporary measure, a WAF rule can block path traversal patterns in requests to the plugin's endpoints, but this may not cover all vectors and could cause false positives. Note that limiting privileged accounts significantly reduces risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a path traversal (CWE-22) in the Kirki plugin, a theme customizer framework for WordPress that is bundled with or used by many themes. The plugin's file handling logic fails to properly validate file paths, allowing an authenticated user at the Editor role (or a compromised higher-privileged account) to supply a crafted path that results in the deletion of arbitrary files on the underlying server. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, and no user interaction; the independent assessment reassessed scope as unchanged (S:U) with low integrity (I:L) and high availability (A:H) impact, confirming the primary risk is disruption of site availability through file removal. The CPE cpe:2.3:a:themeum:kirki:*:*:*:*:*:*:*:* and tags (WordPress, Path Traversal, WordPress Plugin) identify the affected component as the Kirki plugin developed by Themeum.
Know when Kirki gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Editor-only reachability sets PR:H; arbitrary deletion destroys data (I:L) and can down the site (A:H); scope kept U as the action stays within the WordPress host's authority.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Server-Side Request Forgery in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to coerce the s
SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbit
Broken access control in the Themeum Kirki WordPress customizer framework (versions up to and including 6.0.13) allows r
PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users
Stored cross-site scripting in the Kirki WordPress plugin before 6.3.0 allows unauthenticated remote attackers to persis
Arbitrary file upload via malformed archive in the Kirki WordPress customizer plugin (all versions before 6.2.3) allows
Stored cross-site scripting in the Kirki WordPress plugin affects versions 6.0.0 through 6.3.0, which allow SVG files to
SQL injection in the Kirki WordPress plugin (versions 6.0.0 through <6.3.0) enables authenticated users with editor-leve
Unauthenticated shortcode injection in Kirki WordPress plugin (all versions before 6.2.1) allows any remote attacker to
Object injection in the Themeum Kirki WordPress customizer framework (all versions through 6.0.12) allows attackers to a
Blind SQL injection in the Themeum Kirki WordPress customizer framework (all versions up to and including 6.0.12) lets r
Kirki WordPress Customizer Framework plugin before 6.0.14 exposes registered user email addresses, comment author emails
Exploit-DB