CVE-2026-8073CWE-23

Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP

High · published May 19, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
44.5
In the wild
Unconfirmed
What it is

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function in all versions up to, and including, 6.0.6. This makes it possible for unauthenticated attackers to read and delete arbitrary files limited in the WordPress uploads base directory.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00537 · 44.5th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2026-05-19T18:33Z
EPSS history
Timeline
  • 19 MAY 18:33Z
    Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP
    cvelistv5