CVE-2026-65436
Received Received - Intake

Arbitrary File Deletion Vulnerability in Kirki <= 6.0.13

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: Patchstack

Description
Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-65436
EUVD
EUVD-2026-49231

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
arbitrary_file_deletion kirki 6.0.13
wordpress kirki to 6.0.13 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Kirki WordPress plugin versions 6.0.13 and earlier have an Arbitrary File Deletion vulnerability. This allows users with editor or developer privileges to delete files from the website, potentially causing it to malfunction or stop working entirely.

Detection Guidance

Check if the Kirki plugin version is 6.0.13 or earlier. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly. Look for unauthorized file deletions in server logs.

Impact Analysis

If exploited, this vulnerability could lead to website downtime, loss of critical files, or disruption of services. Attackers might target websites in mass-exploit campaigns, increasing the risk of widespread damage.

Compliance Impact

This vulnerability could lead to unauthorized file deletion, potentially compromising data integrity and availability. For GDPR, this may violate Article 5 (integrity and confidentiality) and Article 32 (security of processing). For HIPAA, it could affect the integrity of protected health information under the Security Rule.

Mitigation Strategies

Update the Kirki plugin to version 6.0.14 immediately. If updating is not possible, apply the mitigation rule provided by Patchstack. Restrict editor/developer privileges to minimize attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65436. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart