Introduction
A missing authorization check in a popular WordPress page builder plugin lets any unauthenticated visitor read and delete files in the site's uploads directory with nothing more than a crafted GET request. The Kirki plugin has over 500,000 active installations, so CVE-2026-8073 reaches a large share of WordPress sites.
Kirki, developed by Themeum, is a freeform page builder, website builder, and advanced theme customizer for WordPress. Users design websites visually without writing code. With half a million active installations, it is one of the more widely deployed builder plugins in the WordPress plugin directory.
Technical information
Vulnerability classification
CVE-2026-8073 is classified under CWE-23 (Relative Path Traversal). The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, for a score of 7.5 (High). An attacker needs no privileges and no user interaction, and can exploit the flaw over the network with low attack complexity. The CVSS scoring rates the confidentiality impact High and the integrity and availability impacts None, even though the vulnerability description confirms that file deletion is also possible.
Root cause
The vulnerability is in the downloadZIP function in the API.php file. Two separate flaws combine to make it exploitable:
-
The endpoint has no capability check. It processes incoming GET requests without verifying the caller's authorization level, and no WordPress capability check (such as
current_user_can()) gates access to the function. Any unauthenticated visitor to the site can call the endpoint. -
The file path is not properly validated. The code does not sanitize the file name parameter passed to the function, does not apply the
basename()function or equivalent path normalization, and does not enforce a strict file extension check. An attacker can put relative path traversal sequences in the file name parameter to reach files outside the intended directory, though the traversal stays within the WordPress uploads base directory.
Attack flow
Based on the available source materials, exploitation follows this sequence:
- The attacker identifies a WordPress site running Kirki plugin version 6.0.6 or earlier.
- The attacker crafts a GET request to the
downloadZIPendpoint exposed by the plugin's API. - The request includes a manipulated file name parameter containing path traversal sequences (e.g.,
../patterns) that point to a target file within the WordPress uploads base directory. - Because no capability check exists, the server processes the request whether or not the caller is authenticated.
- Because the function applies no input sanitization or extension validation, it resolves the manipulated path and either serves the file contents to the attacker (file read) or deletes the file (file deletion).
The vulnerability is limited to the WordPress uploads base directory (wp-content/uploads/ by default). That boundary prevents full filesystem traversal, but the uploads directory commonly holds media files, plugin-generated exports, backup archives, and other sensitive data.
What the patch changes
Changeset 3535640 in the WordPress plugin repository shows that version 6.0.7 adds three protections to API.php:
- A capability check using
HelperFunctions, so only authorized users with full access can trigger the endpoint. - Input sanitization on the file name parameter using text sanitization and the
basename()function, which strips directory traversal sequences. - A strict validation check that requires the file extension to be exactly
zipbefore the file path is processed.
Together, these changes close both the authorization bypass and the path traversal vector.
Affected systems and versions
All versions of the Kirki Freeform Page Builder, Website Builder and Customizer plugin from version 0 through version 6.0.6 (inclusive) are vulnerable. Version 6.0.7 contains the fix.
The plugin is distributed through the official WordPress plugin repository and has over 500,000 active installations. Because the vulnerability requires no authentication to exploit, any WordPress site running a vulnerable version is exposed, regardless of its other security configurations.
Vendor security history
Themeum actively maintains the Kirki plugin. According to the changelog, version 6.0.6, the release just before the patched version, also fixed a separate security vulnerability in the media search functionality. That suggests ongoing security remediation, though the provided intelligence does not describe the vendor's broader security track record.
