{
 "id": "WPSEC-2026-2981",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2981/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2981/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2981/index.md",
 "title": "Kirki <= 6.4.1 - Authenticated (Editor+) Arbitrary File Upload via Remote Template ZIP Import",
 "description": "The Kirki plugin for WordPress is vulnerable to Arbitrary File Upload via the remote custom template applied when a page is created, in all versions up to, and including, 6.4.1, due to missing file type validation when the downloaded template ZIP archive is extracted into the web-accessible kirki_temp folder in the uploads directory. This makes it possible for authenticated attackers with editor-level access and above to point the template URL at a ZIP they control and have arbitrary files, including PHP files, written to the server. The files stay there until the folder is deleted after extraction, which may allow remote code execution.",
 "plugin": {
  "slug": "kirki",
  "name": "Kirki",
  "full_name": "Kirki – Freeform Page Builder, Website Builder & Customizer",
  "wordpress_org": "https://wordpress.org/plugins/kirki/",
  "advisories_url": "https://wpsec.com/vuln/plugin/kirki/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/kirki"
 },
 "type": "UPLOAD",
 "cwe": [
  "CWE-434"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.6,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "6.0.0",
    "from_inclusive": true,
    "to": "6.4.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 6.0.0 before 6.4.2"
  ]
 },
 "introduced_in": "6.0.0",
 "fixed_in": "6.4.2",
 "remediation": "Update to 6.4.2 or later.",
 "fix_released": "2026-11-10T08:45:16+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:14:45.811726+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2981/",
  "https://plugins.svn.wordpress.org/kirki/tags/6.4.2/",
  "https://wordpress.org/plugins/kirki/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/kirki",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}