CVE-2026-15601

Name of the Vulnerable Software and Affected Versions Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.0.14

Description Authenticated attackers with custom-level access and above can write arbitrary files on the server, potentially leading to remote code execution. This occurs because the extract zip file() function does not sanitize the app src variable used in the install app, update app, and get kirki template from zip code paths. This lack of validation allows a crafted ZIP file to be fetched and extracted with path-traversing entry names that escape the intended destination directory, a flaw known as Zip Slip (a form of path traversal where files are written outside the target folder).

Recommendations Update Kirki – Freeform Page Builder, Website Builder & Customizer to version 6.0.14 or later.