CVE-2026-15457: Kirki WordPress Path Traversal Flaw

CVE-2026-15457 Overview

CVE-2026-15457 is a directory traversal vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress. The flaw affects all versions up to and including 6.0.13 and stems from insufficient validation of the family parameter. Authenticated attackers with editor-level access or above can delete arbitrary directories on the server. Successful exploitation results in data loss and site availability impact. The vulnerability is categorized under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Editor-level attackers can traverse the file system and delete arbitrary directories, causing data loss and denial of service on affected WordPress installations.

Affected Products

Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress
All versions up to and including 6.0.13
WordPress sites with editor-level (or higher) accounts enabled

Discovery Timeline

2026-07-17 - CVE-2026-15457 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-15457

Vulnerability Analysis

The Kirki plugin exposes functionality that accepts a family parameter used to reference font families on the server. The plugin fails to sanitize path traversal sequences such as ../ within this parameter. When the parameter reaches file system operations, an attacker can supply crafted values that resolve outside the intended font directory. The affected code paths include app/Http/Controllers/Api/GlobalDataController.php, app/Services/FontService.php, includes/Ajax/Media.php, and the REST route defined in routes/api.php.

Because the vulnerable endpoints perform delete operations, the attacker escalates a benign parameter into an arbitrary directory removal primitive. Loss of directories under wp-content, plugin folders, or uploads can permanently disrupt site functionality.

Root Cause

The root cause is missing path canonicalization and traversal filtering on the family request parameter. The plugin trusts client-supplied strings and concatenates them into file system paths without confirming that the resolved path stays within the intended directory boundary. This is a classic CWE-22 pattern where input reaches a sensitive sink without normalization.

Attack Vector

Exploitation requires authenticated access at editor privilege level or above. The attacker sends a request to the vulnerable Kirki endpoints and supplies a family value containing directory traversal sequences. The plugin then executes the deletion operation against the attacker-controlled path. See the WordPress Kirki Global Data Controller and WordPress Kirki Font Service source references for the specific vulnerable code locations. No verified public proof-of-concept exploit code was available at time of writing.

Detection Methods for CVE-2026-15457

Indicators of Compromise

HTTP requests to Kirki API routes containing ..%2F, ../, or URL-encoded traversal sequences in the family parameter
Missing or truncated directories under wp-content/uploads, wp-content/plugins, or other WordPress paths without administrator action
Unexpected editor-account activity targeting Kirki endpoints defined in routes/api.php

Detection Strategies

Inspect web server access logs for requests to Kirki REST or AJAX endpoints (GlobalDataController, FontService, Media handlers) with suspicious family values
Compare current directory listings under the WordPress content root against known-good backups to identify unauthorized deletions
Alert on WordPress audit-log entries showing editor accounts invoking font management functionality outside of normal customization workflows

Monitoring Recommendations

Deploy a WordPress-aware web application firewall rule to block traversal patterns in the family parameter
Monitor file system events on wp-content/ for rmdir or unlink operations performed by the PHP process serving Kirki requests
Correlate authentication logs with file deletion telemetry to identify editor accounts issuing atypical destructive requests

How to Mitigate CVE-2026-15457

Immediate Actions Required

Update the Kirki plugin to a fixed version beyond 6.0.13 as soon as the vendor publishes it, per the Wordfence Vulnerability Report
Audit WordPress user accounts and remove or downgrade unnecessary editor and administrator roles
Back up the WordPress file system and database before applying any changes to preserve recovery options

Patch Information

Review the WordPress Kirki Changeset for the vendor's remediation commit. Apply the latest Kirki plugin release via the WordPress admin dashboard once available, and verify the plugin version reported in wp-admin/plugins.php matches the patched build.

Workarounds

Deactivate the Kirki plugin until a patched version is installed if the site does not require its functionality
Restrict access to /wp-json/kirki/ and related AJAX endpoints via web server rules or a web application firewall
Enforce least-privilege for editor accounts and require multi-factor authentication for all privileged WordPress users

bash

# Example WAF rule concept to block traversal in the family parameter
# (Adapt to your WAF syntax; illustrative only.)
SecRule ARGS:family "@rx (\.\./|\.\.%2f|%2e%2e/)" \
    "id:1015457,phase:2,deny,status:403,\
    msg:'CVE-2026-15457 Kirki directory traversal attempt in family parameter'"