WordPress Plugin Vulnerabilities

Kirki < 6.0.7 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP

Description

The plugin is vulnerable to arbitrary file read and deletion via the `downloadZIP` function due to insufficient file path validation and a missing capability check. This makes it possible for unauthenticated attackers to read and delete files within the WordPress uploads base directory.

Affects Plugins

Plugin icon
kirki
Fixed in 6.0.7

References

CVE
CVE-2026-8073
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/b073edd0-3f40-423e-976e-996b29caf66e

Classification

Type
FILE DELETION
OWASP top 10
A6: Security Misconfiguration
CWE
CWE-73
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
No
WPVDB ID
a15ec85d-2733-4dd3-8560-22953aafa799

Timeline

Publicly Published
2026-05-19 (about 3 months ago)
Added
2026-05-19 (about 3 months ago)
Last Updated
2026-05-19 (about 3 months ago)

Other

Published
Title
Published
2022-11-29
Title
Simple:Press < 6.8.1 - Subscriber+ Arbitrary File Deletion
Published
2025-07-01
Title
Forminator Forms < 1.44.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion
Published
2026-08-10
Title
WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal
Published
2025-12-11
Title
WP User Manager < 2.9.13 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter
Published
2025-02-28
Title
Simple Download Counter < 2.1 - Authenticated (Author+) Arbitrary File Read