CVE-2026-65436 in Kirki Plugin
Summary
by MITRE • 07/27/2026
Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
The vulnerability in Kirki versions 6.0.13 and earlier represents a critical arbitrary file deletion flaw that exploits the editor component's insufficient input validation mechanisms. This issue allows authenticated attackers with editor privileges to manipulate file deletion operations through crafted requests, potentially leading to unauthorized removal of critical system files or configuration data.
The technical root cause stems from improper sanitization of user-supplied parameters within the file management functions. When editors attempt to delete files through the administrative interface, the application fails to adequately validate or sanitize the file paths and identifiers passed to the deletion routines. This vulnerability falls under the CWE-22 category for Improper Limitation of a Pathname to a Restricted Directory, specifically manifesting as a path traversal attack vector that bypasses normal access controls.
Attackers can exploit this weakness by crafting malicious requests that target specific file paths within the application's directory structure, potentially reaching system-critical files outside the intended scope. The operational impact extends beyond simple data loss, as successful exploitation could lead to complete system compromise, service disruption, or unauthorized access to sensitive information. This vulnerability particularly affects WordPress installations using Kirki framework versions up to 6.0.13, where editors have elevated privileges within the content management system.
The attack surface is significantly amplified when considering that many WordPress sites operate with multiple user roles, where editors might be granted broader permissions than initially intended. According to ATT&CK framework, this vulnerability maps to T1078 Valid Accounts and T1499 Endpoint Termination, as it leverages legitimate user credentials to perform destructive operations. The exploitation requires minimal technical expertise beyond understanding basic web application security concepts and WordPress administrative interfaces.
Organizations should immediately implement mitigation strategies including immediate patching to versions 6.0.14 or later, where the vulnerability has been resolved through enhanced input validation and proper path restriction mechanisms. Additional defensive measures encompass implementing role-based access controls that limit editor privileges, monitoring file deletion activities through audit logging, and conducting regular security assessments of third-party plugins and frameworks. The remediation process must include thorough testing to ensure no regressions in functionality while maintaining the integrity of legitimate file management operations.