🔐 CVE Alert

CVE-2026-17604

MEDIUM 4.9

Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter

CVSS Score
4.9
EPSS Score
0.0%
EPSS Percentile
0th

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The intended strpos()-based guard against leaving the uploads directory is bypassed by crafting a URL that includes the uploads base path as a substring while embedding directory traversal sequences, such as /wp-content/uploads/../../wp-config.php.

CWE CWE-22
Vendor themeum
Product kirki – freeform page builder, website builder & customizer
Published Aug 16, 2026
Stay Ahead of the Next One

Get instant alerts for themeum kirki – freeform page builder, website builder & customizer

Be the first to know when new medium vulnerabilities affecting themeum kirki – freeform page builder, website builder & customizer are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability

Affected Versions

themeum / Kirki – Freeform Page Builder, Website Builder & Customizer
0 ≤ 6.1.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/d8ecb2c6-c2d0-44b0-b9c2-4fcbc0f97632?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/kirki/tags/6.1.1/includes/Ajax/ExportImport.php#L186 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/kirki/tags/6.1.1/includes/Ajax/ExportImport.php#L26 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/kirki/tags/6.1.1/includes/Ajax/ExportImport.php#L52 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/kirki/tags/6.1.1/includes/Ajax/ExportImport.php#L182 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/kirki/tags/6.1.1/includes/Ajax.php#L349 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/includes/Ajax/ExportImport.php#L186 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/includes/Ajax/ExportImport.php#L26 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/includes/Ajax/ExportImport.php#L52 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/includes/Ajax/ExportImport.php#L182 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/includes/Ajax.php#L349 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?reponame=&old=3629933%40kirki&new=3629933%40kirki

Credits

Wordfence PRISM