CVE-2026-65436: Kirki Path Traversal Vulnerability

CVE-2026-65436 Overview

CVE-2026-65436 is an arbitrary file deletion vulnerability in the Kirki WordPress plugin affecting versions up to and including 6.0.13. The flaw is classified as a path traversal issue [CWE-22] and allows authenticated users with editor-level privileges to delete arbitrary files on the underlying server. Successful exploitation can remove critical WordPress files such as wp-config.php, forcing the site into a setup state that attackers can leverage for site takeover. The vulnerability is exploitable over the network without user interaction.

Critical Impact
Authenticated editors can delete arbitrary files on the WordPress host, breaking site availability and enabling downstream compromise through forced reinstallation.

Affected Products

Kirki WordPress plugin versions <= 6.0.13
WordPress installations relying on Kirki for customizer framework functionality
Themes and plugins that bundle vulnerable Kirki releases as a dependency

Discovery Timeline

2026-07-27 - CVE-2026-65436 published to the National Vulnerability Database
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-65436

Vulnerability Analysis

CVE-2026-65436 is a path traversal weakness [CWE-22] in the Kirki plugin's file-handling logic. An authenticated user with editor role can supply a crafted path parameter that escapes the intended directory and points to files elsewhere on the filesystem. The plugin then processes the deletion request against the attacker-controlled path.

The issue requires high privileges but no user interaction. Because the scope changes when files outside the plugin's data directory are affected, deletion of core WordPress files such as wp-config.php can trigger a full-site denial of service. Attackers can then re-run the WordPress installer against a database they control, which converts file deletion into a viable takeover primitive.

Root Cause

The root cause is insufficient validation and canonicalization of user-supplied file path input before the plugin invokes a filesystem deletion routine. Directory traversal sequences such as ../ are not stripped or rejected, and no allowlist confines operations to the plugin's own working directory.

Attack Vector

Exploitation requires an authenticated session with editor privileges on the target WordPress site. The attacker issues a request to a Kirki endpoint that accepts a file path parameter, injecting traversal sequences to reference an arbitrary location. The plugin resolves the traversed path and deletes the target file within the web server's permissions. See the Patchstack WordPress Vulnerability Report for advisory details.

Detection Methods for CVE-2026-65436

Indicators of Compromise

Missing or unexpectedly recreated wp-config.php, .htaccess, or theme files on WordPress hosts running Kirki <= 6.0.13
WordPress redirecting to /wp-admin/setup-config.php on a previously configured site
Access log entries containing traversal sequences such as ..%2F or ../ targeting Kirki plugin endpoints under /wp-content/plugins/kirki/
Editor-role accounts issuing POST requests to Kirki AJAX or REST handlers that accept file path parameters

Detection Strategies

Alert on filesystem unlink events targeting WordPress core files initiated by the PHP worker process
Correlate editor-role authentication events with requests to Kirki endpoints containing path metacharacters
Baseline plugin versions across managed WordPress hosts and flag installs matching Kirki <= 6.0.13

Monitoring Recommendations

Enable file integrity monitoring on wp-config.php, .htaccess, and the wp-content directory tree
Ship web server access logs and PHP error logs to a centralized analytics platform for retention and query
Review WordPress user role assignments and monitor for unexpected editor-level account creation

How to Mitigate CVE-2026-65436

Immediate Actions Required

Inventory all WordPress sites and identify installations running Kirki <= 6.0.13
Update Kirki to a patched release once the vendor publishes a fixed version, per the Patchstack advisory
Audit editor-role accounts and remove or downgrade unnecessary privileged users
Enforce multi-factor authentication for all WordPress administrator and editor accounts

Patch Information

Refer to the Patchstack WordPress Vulnerability Report for the authoritative fixed-version guidance. Apply the update through the WordPress plugin manager or via WP-CLI once available.

Workarounds

Temporarily deactivate the Kirki plugin if a patched version is not yet available and the plugin is not required for site operation
Restrict editor-role access to trusted users only until remediation is complete
Deploy a web application firewall rule blocking path traversal sequences in requests to /wp-content/plugins/kirki/
Set restrictive filesystem permissions so the PHP worker cannot delete WordPress core files outside wp-content

bash

# Configuration example: update Kirki via WP-CLI once a patched version is released
wp plugin update kirki --version=<patched-version>
wp plugin list --name=kirki --fields=name,status,version