Kirki <= 6.4.1 - Authenticated (Editor+) Arbitrary File Upload via Remote Template ZIP Import
- ID
- WPSEC-2026-2981
- Plugin
- Kirki – Freeform Page Builder, Website Builder & Customizer (kirki)
- Affected
- from 6.0.0 before 6.4.2
- Remediation
- Update to 6.4.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-434
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Kirki on WPSec AttackSurface
- Fix released
- Published
Description
The Kirki plugin for WordPress is vulnerable to Arbitrary File Upload via the remote custom template applied when a page is created, in all versions up to, and including, 6.4.1, due to missing file type validation when the downloaded template ZIP archive is extracted into the web-accessible kirki_temp folder in the uploads directory. This makes it possible for authenticated attackers with editor-level access and above to point the template URL at a ZIP they control and have arbitrary files, including PHP files, written to the server. The files stay there until the folder is deleted after extraction, which may allow remote code execution.
References
- https://wpsec.com/vuln/WPSEC-2026-2981/
- https://plugins.svn.wordpress.org/kirki/tags/6.4.2/
- https://wordpress.org/plugins/kirki/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS