Junglewise Threat Intelligence

CVE-2026-15601: Kirki Freeform Page Builder Path Traversal in extract_zip_file

CVE-2026-15601 · Severity: medium · CVSS 4.9 · Published 2026-08-01

Executive brief

The Kirki plugin for WordPress, a tool used for building and customizing websites, contains a security flaw in how it handles compressed files. An authorized user with specific permissions could upload a specially crafted file that places malicious code in sensitive areas of the web server. This could allow an attacker to take full control of the website or execute unauthorized commands.

Technical details

The Kirki plugin for WordPress is vulnerable to a Zip Slip (Path Traversal) vulnerability within the extract_zip_file function. The vulnerability exists in the install_app, update_app, and get_kirki_template_from_zip code paths, which accept a user-supplied 'app src' value to construct a download URL. Because the plugin fails to sanitize entry names within the fetched ZIP archive, an attacker can include path traversal sequences (e.g., ../) to write files outside of the intended directory. This requires high-level authenticated access (custom-level and above) but can lead to Remote Code Execution (RCE) if the attacker overwrites or creates executable PHP files. The issue is present in all versions up to and including 6.0.13.

Affected products

  • themeum Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.13

Timeline

  • 2026-08-01: advisory: NVD publication date

References