CVE-2026-15601: Kirki WordPress Path Traversal Vulnerability

CVE-2026-15601 Overview

CVE-2026-15601 is a Path Traversal (Zip Slip) vulnerability affecting the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress. The flaw exists in all versions up to and including 6.0.13, within the extract_zip_file function. Authenticated attackers with custom-level access or higher can write arbitrary files on the server by supplying a crafted ZIP archive containing path-traversing entry names. Successful exploitation can lead to remote code execution on the affected WordPress instance. The vulnerability is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Authenticated attackers can write arbitrary files outside the intended extraction directory, enabling remote code execution on WordPress sites running the Kirki plugin.

Affected Products

Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress
All versions up to and including 6.0.13
WordPress installations with the Kirki plugin activated and users holding custom-level access or above

Discovery Timeline

2026-08-01 - CVE-2026-15601 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-15601

Vulnerability Analysis

The vulnerability resides in the Kirki plugin's application installation and template import workflow. The install_app, update_app, and get_kirki_template_from_zip code paths accept a user-supplied app src value used to construct the remote download URL. The plugin fetches the referenced ZIP archive and passes it to the extract_zip_file routine in FileHandler.php for extraction. No validation is applied to archive entry names before extraction, allowing entries containing ../ sequences to escape the intended destination directory. An attacker can host a malicious ZIP archive containing a PHP payload with a traversal path, trigger the vulnerable endpoint, and place the file into a web-accessible location such as the WordPress plugin, theme, or upload directory.

Root Cause

The root cause is missing sanitization of ZIP entry names during archive extraction, a class of vulnerability commonly referred to as Zip Slip. The extract_zip_file function in app/Supports/FileHandler.php (line 90) does not normalize or validate destination paths against the target base directory. Additionally, the app src parameter is not restricted to a trusted domain allow-list, so attackers control both the archive contents and its origin.

Attack Vector

Exploitation requires an authenticated WordPress user with custom-level access or higher. The attacker crafts a ZIP archive containing files with entry names such as ../../../../wp-content/plugins/malicious.php. The attacker then invokes one of the vulnerable API routes exposed under routes/api.php (line 77) or the AJAX handler in includes/Ajax/Apps.php (line 176), supplying an app src value pointing to the attacker-controlled URL. The plugin downloads the ZIP, extracts it via AppsService.php (lines 113 and 186), and writes the traversing file to a location outside the intended directory. See the Wordfence Vulnerability Report for additional context.

No verified public exploit code is available. Technical references are limited to the plugin source in the WordPress Kirki AppsController Code and the WordPress Kirki FileHandler Code.

Detection Methods for CVE-2026-15601

Indicators of Compromise

Unexpected PHP files written under wp-content/plugins/, wp-content/themes/, or wp-content/uploads/ with recent modification timestamps.
Outbound HTTP requests from the WordPress server fetching ZIP archives from untrusted domains during install_app or update_app operations.
Kirki plugin log or debug entries referencing extract_zip_file extraction of archives with entry names containing ../ sequences.
New administrative or scheduled task entries created shortly after Kirki app installation events.

Detection Strategies

Monitor WordPress access logs for POST requests to Kirki API routes (/wp-json/kirki/) and AJAX handlers invoking install_app, update_app, or get_kirki_template_from_zip actions.
Perform file integrity monitoring on WordPress core, plugin, and theme directories to detect unauthorized file writes.
Inspect ZIP archives downloaded by the WordPress server for entry names containing traversal sequences before extraction.

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized analytics platform and alert on Kirki API calls from non-administrative user contexts.
Track outbound HTTPS requests from PHP worker processes to identify unexpected remote ZIP downloads.
Correlate authentication events for custom-role users with plugin management API activity to surface abuse patterns.

How to Mitigate CVE-2026-15601

Immediate Actions Required

Update the Kirki plugin to a version later than 6.0.13 as soon as a fixed release is available from the vendor.
Audit WordPress user roles and remove custom-level or higher privileges from accounts that do not require them.
Review wp-content/ directories for unauthorized PHP files and remove any suspicious artifacts.
Rotate credentials and API keys for any WordPress accounts that had access to Kirki app management functions.

Patch Information

The vulnerability is present in Kirki through version 6.0.13. Refer to the WordPress Kirki Change Set and the Wordfence Vulnerability Report for the latest patch status and remediation guidance.

Workarounds

Deactivate the Kirki plugin until a patched version is installed if the app installation feature is not required.
Restrict access to the WordPress REST API endpoints exposed by Kirki using a web application firewall rule that blocks requests to /wp-json/kirki/ from unauthorized sources.
Enforce least-privilege role assignment and disable custom roles that grant access to Kirki app management.
Configure the WordPress server to disallow PHP execution in wp-content/uploads/ via web server rules to limit post-exploitation impact.

bash

# Example Nginx rule to block PHP execution in the uploads directory
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}