What the vulnerability does
01Description
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The intended strpos()-based guard against leaving the uploads directory is bypassed by crafting a URL that includes the uploads base path as a substring while embedding directory traversal sequences, such as /wp-content/uploads/../../wp-config.php.
Explanation of Vulnerability in Simple Terms
02Summary
Kirki versions up to 6.1.1 contain a path traversal vulnerability that allows high-privilege users to read arbitrary files from the server. An attacker with admin or editor access can craft requests to access files outside the intended directory, potentially exposing sensitive configuration files, database credentials, or other private data. The vulnerability requires administrative privileges and does not allow file modification or deletion.
What an attacker can do
03Attacker Capabilities
Read arbitrary files from the server filesystem.
Potential impact on your site
04Site Impact
Sensitive files like wp-config.php or .env may be exposed to privileged users.
Conditions required to exploit
05Prerequisites
Attacker must have high-level site privileges (admin or editor role).
Key dates
06Disclosure timeline
August 16, 2026
CVE published
