CVE-2026-17604 in Kirki Plugin
Summary
by MITRE • 08/16/2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The intended strpos()-based guard against leaving the uploads directory is bypassed by crafting a URL that includes the uploads base path as a substring while embedding directory traversal sequences, such as /wp-content/uploads/../../wp-config.php.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability in the Kirki plugin represents a critical directory traversal flaw that undermines the security posture of WordPress installations. This weakness exists within the plugin's handling of the 'data' parameter, which processes file paths without proper sanitization or validation mechanisms. The issue affects all versions up to and including 6.1.1, making it a widespread concern for numerous websites that rely on this popular page builder and customizer tool. The vulnerability specifically targets authenticated users who possess editor-level privileges or higher, creating a significant risk vector where insiders can exploit their access rights to gain unauthorized information disclosure.
The technical exploitation of this vulnerability relies on the bypass of a intended security mechanism that was designed to prevent path traversal outside the uploads directory using strpos() function checks. Attackers can circumvent this protection by crafting malicious URLs that embed the uploads base path as a substring while simultaneously incorporating directory traversal sequences like ../../. This technique allows them to navigate beyond the designated upload boundaries and access arbitrary files on the server filesystem. The specific example of accessing wp-config.php demonstrates the severity of potential information disclosure, as this file typically contains database credentials, security keys, and other sensitive configuration data that could compromise the entire WordPress installation.
The operational impact extends far beyond simple information disclosure, as this vulnerability creates a pathway for attackers to escalate privileges and potentially gain complete control over affected systems. The ability to read server files means that attackers can extract database connection details, plugin configurations, user credentials stored in configuration files, and other sensitive data that could be used for further exploitation. This vulnerability directly maps to CWE-22 Directory Traversal and aligns with ATT&CK technique T1083 File and Directory Discovery, where adversaries seek to understand the target's file structure. The fact that this requires only editor-level access makes it particularly dangerous as it can be exploited by users who should normally have limited privileges within a WordPress environment.
Mitigation strategies must address both immediate remediation and long-term security hardening measures. The primary solution involves updating to the latest version of the Kirki plugin where the directory traversal vulnerability has been patched. Organizations should also implement additional security controls such as restricting file upload capabilities, implementing proper input validation for all user-supplied parameters, and conducting regular security audits of installed plugins. Network-based protections like web application firewalls can help detect and block suspicious traversal attempts, while monitoring systems should be configured to alert on unusual file access patterns. Additionally, organizations should enforce the principle of least privilege by ensuring that only essential users have editor-level access or higher, thereby reducing the attack surface for this particular vulnerability. The incident highlights the critical importance of thorough input validation and proper path handling in web applications, as even well-intentioned security measures can be bypassed through creative exploitation techniques.