Quick answers
- Is CVE-2026-74992 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-74992 being exploited in the wild.
- How severe is CVE-2026-74992?
- Medium severity, with a CVSS score of 6.8, published 20 August 2026.
- Which products and versions are affected?
- Kirki Kirki before 6.2.3.
- Is there a fix for CVE-2026-74992?
- A patch was published on 2026-08-20: version 6.2.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-74992 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-74992?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Kirki plugin before version 6.2.3 contains an arbitrary file upload vulnerability in its font ZIP upload handler (kirki_post_apis endpoint with upload-font-zip action). The vulnerability arises from insufficient validation of archive contents and incomplete cleanup after extraction—the plugin only removes unwanted files at the top level of the extracted directory, not in subdirectories. An authenticated user with the Editor role can craft a malicious ZIP containing a valid stylesheet.css and font file (to bypass initial validation) plus arbitrary payload files (HTML, SVG, .htaccess, etc.) in subdirectories, which are then extracted to a web-accessible directory (/wp-content/uploads/kirki-fonts/). No administrator action is required since Kirki grants Editor-level users full plugin access at activation. An unauthenticated attacker can then fetch and execute these planted files—stored XSS via HTML/SVG, or RCE via .htaccess+PHP on Apache configurations permitting it. The fix is available in version 6.2.3.
Affected products
- Kirki Kirki before 6.2.3
Timeline
- 2026-08-18: disclosed
- 2026-08-20: patched: version 6.2.3