Arbitrary File Deletion Vulnerability in Kirki Page Builder Plugin for WordPress
CVE-2026-8073

7.5HIGH

Key Information:

Vendor

WordPress
Status
Kirki – Freeform Page Builder, Website Builder & Customizer
Vendor
CVE Published:
19 May 2026

What is CVE-2026-8073?

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is affected by a vulnerability that allows unauthenticated attackers to delete arbitrary files due to inadequate file path validation and a lack of capability checks in the 'downloadZIP' function. This flaw can lead to significant security risks as it exposes sensitive information and disrupts website operations by enabling unauthorized file deletion within the WordPress uploads directory.

Affected Version(s)

Kirki – Freeform Page Builder, Website Builder & Customizer 0 <= 6.0.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/kirki/tags/6.0...
https://plugins.trac.wordpress.org/changeset/3535640/kirk...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad
.