CVE-2026-74992: Kirki WordPress Plugin RCE Vulnerability

CVE-2026-74992 Overview

CVE-2026-74992 affects the Kirki WordPress plugin in versions prior to 6.2.3. The plugin fails to validate files contained in archives uploaded by users with the Editor role. It also does not remove unwanted files after extraction. Attackers with Editor privileges can upload arbitrary files to a web-accessible directory. This behavior enables Stored Cross-Site Scripting (XSS) and, on some server configurations, Remote Code Execution (RCE). The weakness is tracked under CWE-79.

Critical Impact
Authenticated Editor-level users can plant arbitrary files in web-served directories, leading to persistent XSS against site visitors and administrators, and potential RCE depending on the underlying server configuration.

Affected Products

Kirki WordPress plugin versions prior to 6.2.3
WordPress sites granting the Editor role to untrusted users
Server configurations that execute uploaded file types placed in web-accessible directories

Discovery Timeline

2026-08-20 - CVE-2026-74992 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-74992

Vulnerability Analysis

The Kirki plugin exposes an archive upload feature accessible to Editor-role users. The extraction routine trusts the archive contents without validating each file's type or extension. It also fails to purge unauthorized files after decompression. As a result, an attacker with Editor credentials can craft an archive containing malicious payloads such as HTML, JavaScript, or server-executable files. Once extracted into a web-accessible directory, these files can be served directly by the web server. The impact ranges from Stored XSS execution in visitor browsers to Remote Code Execution when the server processes uploaded scripts. The EPSS probability is 0.29%, placing this CVE in the 21.6th percentile of exploited vulnerabilities.

Root Cause

The root cause is insufficient input validation during archive extraction. The plugin does not enforce an allowlist of permitted file types inside uploaded archives. It also lacks a cleanup step to remove files that should not remain after processing. Both flaws combine to permit arbitrary file placement.

Attack Vector

An attacker must first obtain Editor role credentials on the target WordPress site. The attacker then uploads a crafted archive through the Kirki plugin's interface. The plugin extracts the archive without filtering its contents. The attacker retrieves the planted file through its web-accessible URL to trigger XSS or code execution. Because the attack requires an authenticated privileged user and user interaction with the plugin workflow, exploitation is gated but feasible in multi-author sites.

See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-74992

Indicators of Compromise

Unexpected .php, .phtml, .html, or .js files appearing in Kirki plugin upload directories under wp-content/
Archive files (.zip, .tar, .gz) uploaded by Editor accounts followed by new file artifacts in web-accessible paths
Outbound requests from the web server to unknown hosts shortly after Editor account activity
Web access log entries showing GET requests to newly created files inside plugin directories

Detection Strategies

Audit WordPress plugin directories for files with executable or script extensions that do not match the plugin's expected file inventory
Correlate Editor account login events with archive uploads and subsequent file system changes
Deploy file integrity monitoring on the wp-content/plugins/kirki/ and related upload paths

Monitoring Recommendations

Enable WordPress audit logging for Editor role actions, especially plugin upload operations
Alert on the creation of script files inside plugin or upload directories
Monitor web server logs for direct requests to files that bypass the WordPress request handler

How to Mitigate CVE-2026-74992

Immediate Actions Required

Upgrade the Kirki plugin to version 6.2.3 or later on all WordPress installations
Review recent archive uploads by Editor accounts and remove any unauthorized files
Rotate credentials for Editor accounts if compromise is suspected
Restrict the Editor role assignment to trusted users until patching is complete

Patch Information

The Kirki maintainers addressed the issue in version 6.2.3 by validating archive contents and removing unwanted files after extraction. Refer to the WPScan Vulnerability Report for the fixed version reference.

Workarounds

Temporarily revoke archive upload capabilities from Editor accounts until the plugin is updated
Configure the web server to disallow execution of script files within wp-content/uploads/ and plugin upload directories
Deploy a Web Application Firewall (WAF) rule to block archive uploads containing script file extensions

bash

# Apache: block script execution in Kirki upload directories
<Directory "/var/www/html/wp-content/plugins/kirki">
    <FilesMatch "\.(php|phtml|phar|html?|js)$">
        Require all denied
    </FilesMatch>
</Directory>