Kirki < 6.2.0 - Editor+ Arbitrary File Read via 'data' Parameter

Description

The plugin is vulnerable to Directory Traversal via the 'data' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The intended strpos()-based guard against leaving the uploads directory is bypassed by crafting a URL that includes the uploads base path as a substring while embedding directory traversal sequences, such as /wp-content/uploads/../../wp-config.php.