CVE-2026-15601
Received Received - Intake

Path Traversal in Kirki WordPress Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: Wordfence

Description
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, and including, 6.0.13 via the extract_zip_file function. This makes it possible for authenticated attackers, with custom-level access and above, to write arbitrary files on the server, which can allow for remote code execution. The install_app, update_app, and get_kirki_template_from_zip code paths accept a user-supplied app src value to construct the download URL, and no sanitization is applied to prevent a crafted ZIP from being fetched and extracted with path-traversing entry names that escape the intended destination directory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-15601
EUVD
EUVD-2026-51745

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aristath kirki to 6.0.13 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Path Traversal (Zip Slip) issue in the Kirki plugin for WordPress. It allows authenticated attackers with custom-level access or higher to write arbitrary files on the server by exploiting a flaw in the extract_zip_file function. The vulnerability occurs because user-supplied ZIP files are not properly sanitized, enabling path-traversing entry names that escape the intended extraction directory.

Detection Guidance

This vulnerability requires checking for unauthorized file writes or suspicious ZIP file extractions in the Kirki plugin. Review server logs for unexpected file creation paths, especially in WordPress directories. Look for ZIP files fetched from untrusted sources via the install_app, update_app, or get_kirki_template_from_zip functions.

Impact Analysis

An attacker could exploit this to upload malicious files to your server, potentially leading to remote code execution. This could allow them to take control of your website, steal data, or perform other unauthorized actions. The impact depends on the server's configuration and the attacker's goals.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating compliance requirements under GDPR, HIPAA, or other regulations. Organizations may face legal penalties, reputational damage, and loss of trust if sensitive data is exposed due to this flaw.

Mitigation Strategies

Update the Kirki plugin to the latest version beyond 6.0.13 immediately to patch the Path Traversal vulnerability. Remove or disable the plugin if an update is not available. Restrict custom-level and above user access to minimize attack surface. Monitor server files for unauthorized changes or new files in unexpected directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15601. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart