CVE-2026-15601 Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)
Authenticated attackers can exploit a Zip Slip vulnerability in the Kirki WordPress plugin to write arbitrary files and achieve remote code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15601?
CVE-2026-15601 is a medium-severity path traversal vulnerability in themeum Kirki – Freeform Page Builder, Website Builder & Customizer, published on 1 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, and including, 6.0.13 via the extract_zip_file function. This makes it possible for authenticated attackers, with custom-level access and above, to write arbitrary files on the server, which can allow for remote code execution. The install_app, update_app, and get_kirki_template_from_zip code paths accept a user-supplied app src value to construct the download URL, and no sanitization is applied to prevent a crafted ZIP from being fetched and extracted with path-traversing entry names that escape the intended destination directory.
Weakness: CWE-22
Which versions are affected by CVE-2026-15601?
How do I fix CVE-2026-15601?
No fix has been published for CVE-2026-15601 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-15601 being exploited?
There is no known exploitation of CVE-2026-15601 in the wild and no public exploit code.
Sources
Also known as GHSA-w4j2-hwpx-q9c7.