EUVD-2026-51745
GHSA-w4j2-hwpx-q9c7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain custom-level WordPress credentials
-
DeliveryCall app install/update API endpoint with malicious app src URL
-
ExploitPlugin fetches attacker-hosted crafted ZIP
-
Executionextract_zip_file writes traversing entry to web-accessible path
-
PersistRequest the written PHP webshell
-
ImpactExecute arbitrary server-side commands
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress session with 'custom-level' access or above - meaning the attacker must hold a WordPress user role that grants capability to invoke the plugin's app management API endpoints (install_app, update_app, or get_kirki_template_from_zip). The plugin must be installed and active. The vulnerable code path is triggered by supplying a crafted app src parameter to those endpoints; no additional non-default configuration is required beyond the plugin being enabled. Exploitation is limited by the authentication bar: unauthenticated attackers cannot reach the vulnerable functionality. The web server process must have write permission to directories outside the intended extraction destination for the path traversal to land a file in a useful location (e.g., wp-content/uploads or wp-content/themes). On hardened installations where PHP execution is blocked in uploads directories, RCE escalation may be impeded but arbitrary file write elsewhere remains possible. |
| Impact | The provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, score 4.9) contains a notable inconsistency: C:H/I:N does not reflect the actual primitive - Zip Slip is a write vulnerability, and the description explicitly states arbitrary file write leading to RCE. The assessor appears to have scored confidentiality impact only, omitting the integrity dimension entirely. This understates real-world risk. The PR:H requirement - custom-level WordPress access - is the primary brake on exploitation; this narrows the realistic attacker population to compromised or malicious privileged users. However, on sites using custom roles, resellers, or delegated plugin management, the 'custom-level' threshold may be lower than traditional Administrator. No EPSS score or KEV listing was provided; without those signals, risk must be anchored to the structural factors: the attack is network-delivered, low-complexity once authenticated, and the RCE escalation path requires only writing a PHP file to a web-accessible directory - a well-understood technique. The combination of high attack complexity relative to the initial auth bar but trivial post-auth exploitation makes this a medium-to-high priority for any WordPress deployment running Kirki with non-admin custom roles. |
| Exploit ScenarioDerived | An attacker with a custom-level WordPress account (for example, a compromised theme developer account on a multi-author site) calls the app installation endpoint with an app src value pointing to an attacker-controlled server hosting a crafted ZIP. The ZIP contains an entry named something like ../../wp-content/uploads/shell.php with PHP webshell content. The plugin fetches and extracts the ZIP without validating entry names, writing the shell to the web-accessible uploads directory. The attacker then issues HTTP requests to shell.php to execute arbitrary OS commands as the web server user. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 01, 2026
Zip Slip path traversal in the Kirki WordPress plugin (all versions through 6.0.13) enables authenticated attackers with custom-level access or above to write arbitrary files anywhere on the server, leading to remote code execution. The root cause is the plugin's app installation and update workflows - install_app, update_app, and get_kirki_template_from_zip - which fetch a user-supplied external ZIP URL via an unsanitized app src parameter and extract its contents without validating entry names for path-traversal sequences. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the write-to-RCE escalation path is mechanically straightforward once the authentication bar is cleared.
RemediationAI
Upstream fix available (WordPress plugin repository changeset 3617070 at https://plugins.trac.wordpress.org/changeset?reponame=&old=3617070%40kirki&new=3617070%40kirki); the exact patched release version number is not independently confirmed from the available data - update to the latest available Kirki release in the WordPress plugin directory and verify the version exceeds 6.0.13. As a compensating control until patching is possible, restrict the WordPress custom roles that can access the app installation and update functionality by removing the relevant capabilities from non-administrator roles; this eliminates the attack surface for non-admin users entirely. Additionally, web application firewall rules that block requests containing ZIP-related path traversal sequences (../ encoded variants) to the plugin's API endpoints can reduce exposure. Neither control is a substitute for patching, as a determined administrator-level attacker bypasses both.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability (CWE-22, Path Traversal) is a classic Zip Slip: when a ZIP archive is extracted, its entry names are used to reconstruct destination file paths, but if those names contain sequences such as '../../', extraction can escape the intended target directory. The affected plugin - cpe:2.3:a:themeum:kirki_-_freeform_page_builder,_website_builder_&_customizer:*:*:*:*:*:*:*:* - implements app management features (install, update, template import) that fetch ZIP files from an attacker-controllable URL. The extract_zip_file function in app/Supports/FileHandler.php (line 90) performs extraction without canonicalizing or rejecting entry names that traverse outside the designated destination. The three vulnerable entry points - AppsService.php (lines 113, 186), AppsController.php (line 27), Ajax/Apps.php (line 176), and routes/api.php (line 77) - share the flaw because all pass the unsanitized app src value downstream to the same extraction routine. The result is that any file writable by the PHP/web server process (typically the entire WordPress install tree) becomes a write target.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
PR:H reflects custom-level auth requirement; S:C and full C/I/A:H reflect arbitrary file write enabling RCE that escapes the WordPress application boundary.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, and including, 6.0.13 via the extract_zip_file function. This makes it possible for authenticated attackers, with custom-level access and above, to write arbitrary files on the server, which can allow for remote code execution. The install_app, update_app, and get_kirki_template_from_zip code paths accept a user-supplied app src value to construct the download URL, and no sanitization is applied to prevent a crafted ZIP from being fetched and extracted with path-traversing entry names that escape the intended destination directory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB