Product

Kirki – Freeform Page Builder, Website Builder & Customizer Plugin

1 brief RSS

WordPress Kirki Plugin Arbitrary File Deletion (CVE-2026-8073)

The Kirki plugin for WordPress is vulnerable to arbitrary file deletion via CVE-2026-8073 due to insufficient file path validation and a missing capability check in the 'downloadZIP' function, allowing unauthenticated attackers to delete files within the WordPress uploads directory.

Kirki – Freeform Page Builder, Website Builder & Customizer plugin cve wordpress file-deletion

2r 1t 1c 1d ago