Executive brief
The Kirki plugin for WordPress, which provides website building and customization tools, contains a security flaw that allows certain authorized users to delete folders on the web server. An attacker with editor-level permissions or higher could exploit this to remove critical website directories. This can lead to significant data loss and cause the website to become unavailable.
Technical details
A directory traversal vulnerability exists in the Kirki plugin for WordPress due to insufficient validation of the 'family' parameter in various components, including the FontService and GlobalDataController. Authenticated attackers with high-level privileges (Editor or Administrator) can supply manipulated paths to traverse the file system. This flaw allows for the unauthorized deletion of arbitrary directories on the server. The vulnerability affects all versions up to and including 6.0.13. Exploitation requires network access to the WordPress site and valid high-level credentials.
Affected products
- Themeum Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.13
Timeline
- 2026-07-17: disclosed: CVE published to NVD dataset
References
- https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/app/Http/Controllers/Api/GlobalDataController.php
- https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/app/Services/FontService.php
- https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/includes/Ajax/Media.php
- https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/routes/api.php
- https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.13/app/Http/Controllers/Api/GlobalDataController.php
- https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.13/app/Services/FontService.php
- https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.13/includes/Ajax/Media.php