PT-2026-41998 · WordPress · Kirki
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.0.7
Description
Insufficient file path validation and a missing capability check in the
downloadZIP() function allow unauthenticated attackers to read and delete arbitrary files. This action is limited to the WordPress uploads base directory.Recommendations
Update to a version later than 6.0.6.
As a temporary workaround, consider disabling the
downloadZIP() function until the update is applied.Fix
DoS
Relative Path Traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Kirki