CVE Database /
CVE-2026-8073
CVE · High
CVE-2026-8073 — Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.7
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-8073
|
Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.7 |
Relative Path Traversal |
High
7.5
|
< 6.0.7
|
6.0.7 |
2026-05-19 |
—
|
CVE-2026-8073
The Kirki plugin, used for page building and customization on WordPress, has a vulnerability allowing unauthenticated users to delete any file within the WordPress upload directory. This flaw arises from inadequate validation of file paths and insufficient capability checks in the 'downloadZIP' function across all versions up to 6.0.6.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings