CVE Database /
CVE-2026-8073
CVE · High
CVE-2026-8073 — Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.7
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-8073
|
Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.7 |
Relative Path Traversal |
High
7.5
|
< 6.0.7
|
6.0.7 |
2026-05-19 |
—
|
CVE-2026-8073
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function in all versions up to, and including, 6.0.6. This makes it possible for unauthenticated attackers to read and delete arbitrary files limited in the WordPress uploads base directory.
Source:
CVE.org
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings