CVE-2026-74992 in Kirki Plugin
Summary
by MITRE • 08/20/2026
The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored XSS as well as RCE on some server configurations.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in versions of the Kirki WordPress plugin prior to 6.2.3 represents a critical failure in input validation and file handling mechanisms within the context of user-generated content processing. This flaw specifically impacts users assigned the Editor role or higher, who possess sufficient privileges to upload theme customizations via archive files through the plugin's interface. The core technical deficiency lies in the inadequate sanitization logic applied during the extraction phase of uploaded archives. While the initial submission might appear to adhere to basic format requirements, the internal processing pipeline fails to rigorously validate the contents contained within these compressed packages before they are written to the server filesystem. This oversight allows malicious actors who have achieved Editor-level access on a compromised WordPress installation to bypass intended restrictions and inject arbitrary file types into web-accessible directories.
The operational impact of this vulnerability is severe, primarily due to its potential for Stored Cross-Site Scripting (XSS) and Remote Code Execution (RCE). When an attacker uploads a malicious archive containing PHP scripts or other executable code disguised as legitimate theme files, the plugin extracts these files directly into public-facing directories without sufficient filtering. Once stored on the server, these files can be accessed via HTTP requests. In scenarios where the web server is configured to execute PHP within those specific directories, this leads directly to Remote Code Execution, granting the attacker full control over the underlying system. Even in configurations that do not automatically execute scripts from arbitrary locations, the ability to store persistent malicious payloads enables Stored XSS attacks against administrators or users who view the affected pages, facilitating session hijacking and further compromise of the administrative account.
From a classification perspective, this vulnerability aligns with CWE-434, which describes the Unrestricted Upload of File with Dangerous Type. The failure extends beyond mere type checking to include CWE-22, Improper Limitation of a Pathname to a Restricted Directory, as the extraction process does not adequately constrain file placement or validate internal paths within the archive against directory traversal attacks. Furthermore, the persistence mechanism and subsequent exploitation vector map directly to MITRE ATT&CK technique T1505.003, Web Shell: ASPX, PHP, JSP, CGI, which details how attackers install web shells for persistent access. The lack of post-extraction cleanup also reflects CWE-78, Improper Neutralization of Special Elements used in an OS Command, if the extraction logic inadvertently triggers shell commands or fails to strip executable permissions and metadata that could aid exploitation.
Mitigation strategies must focus on immediate remediation through version updates alongside robust defensive configurations for environments where updating is not immediately feasible. The primary defense is upgrading the Kirki plugin to version 6.2.3 or later, which addresses these validation gaps by implementing stricter file type whitelisting and ensuring that all non-essential files are purged after extraction. For administrators unable to update immediately, it is critical to restrict upload capabilities for Editor roles if possible, although this may impact workflow. Additionally, web server configurations should be audited to ensure that executable permissions are not granted by default in directories designated for theme uploads or customizations. Implementing a Web Application Firewall (WAF) with rules targeting common PHP shell signatures and anomalous file upload patterns can provide an additional layer of detection. Regular integrity monitoring using tools like Wordfence or Sucuri is also recommended to detect any unauthorized changes to the filesystem that may indicate exploitation attempts.