Arbitrary File Upload Vulnerability in Kirki WordPress Plugin by GetBowtied
CVE-2026-74992
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-74992?
The Kirki WordPress plugin, prior to version 6.2.3, features a vulnerability where file validation for user-uploaded archives is inadequate. Users with the Editor role can upload malicious files, as the plugin fails to securely handle these uploads by not correctly removing all unnecessary files after extraction. This oversight may lead to serious security risks such as Stored Cross-Site Scripting (XSS) and potential Remote Code Execution (RCE) on specific server configurations.
Affected Version(s)
Kirki 0 < 6.2.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.