WordPress Kirki Plugin Path Traversal to Arbitrary Directory Deletion (CVE-2026-15457)

Vulnerability Overview Vulnerability Name: Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter CVE ID: CVE-2026-15457 CVSS Score: 4.9 (Medium) Publication Date: July 16, 2026 Last Updated: July 17, 2026 Researchers: PRISM - Wordfence Impact Scope Software Type: Plugin Software Name: Kirki – Freeform Page Builder, Website Builder & Customizer Affected Versions: <= 6.0.13 Fixed Version: 6.0.14 or later Remediation Remediation Advice: Update to version 6.0.14 or later. Vulnerability Description Description: The Kirki – Freeform Page Builder, Website Builder & Customizer plugin, in versions 6.0.13 and earlier, contains a directory traversal vulnerability. An attacker can use the 'family' parameter to delete arbitrary directories on the server, potentially leading to data loss and reduced availability. Reference Links plugins.trac.wordpress.org Sharing Options Facebook Twitter LinkedIn Email Additional Information Recent Vulnerabilities: The page lists other vulnerabilities for the Kirki plugin, including unauthenticated PHP object injection, unauthenticated stored cross-site scripting (XSS), and unauthenticated SQL injection. Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Contact Information Technical Support: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: Customer support responds 24/7/365 with a 1-hour response time. Additional Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media X (Twitter) Facebook LinkedIn Instagram Subscription Stay Updated: Subscribe to receive the latest security vulnerability information. Footer Links Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Additional Info Wordfence Intelligence: Offers free access to personal and commercial APIs, as well as free webhook integrations, for the latest vulnerability information. Disclaimer Disclaimer: This record contains copyrighted material. Additional Info Additional: If you have any questions or need more information, please contact wfi-support@wordfence.com. Additional Info Additional: This record contains copyrighted material. Additional Info Additional: If you have any questions or need more information, please contact wfi-support@wordfence.com. Additional Info Additional: This record contains copyrighted material. Additional Info Additional: If you have any questions or need more information, please contact wfi-support@wordfence.com. Additional Info Additional: This record contains copyrighted material. Additional Info Additional: If you have any questions or need more information, please contact wfi-support@wordfence.com. Additional Info Additional: This record contains copyrighted material. Additional Info Additional: If you have any questions or need more information, please contact wfi-support@wordfence.com. Additional Info Additional: This record contains copyrighted material. Additional Info Additional: If you have any questions or need more information, please contact wfi-support@wordfence.com. Additional Info Additional: This record contains copyrighted material. Additional Info Additional: If you have any questions or need more information, please contact wfi-support@wordfence.com. Additional Info Additional: This record contains copyrighted material. Additional Info Additional: If you have any questions or need more information, please contact wfi-support@wordfence.com. Additional Info Additional: This record contains copyrighted material. Additional Info Additional: If you have any questions or need more information, please contact wfi-support@wordfence.com. Additional Info Additional: This record contains copyrighted material. Additional Info Additional: If you have any questions or need more information, please contact wfi-support@wordfence.com. Additional Info Additional: This record contains copyrighted material. Additional Info Additional: If you have any questions or need more information, please contact wfi-support@wordfence.com. Additional Info Additional: This record contains copyrighted material. Additional Info Additional: If you have any questions or need more information, please contact wfi-support@wordfence.com. Additional Info Additional: This record contains copyrighted material. Additional Info Additional: If you have any questions or need more information, please contact wfi-support@wordfence.com. Additional Info Additional: This record contains copyrighted material. Additional Info Additional: If you have any questions or need more information, please contact wfi-support@wordfence.com. Additional Info Additional:

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Kirki Plugin Path Traversal to Arbitrary Directory Deletion (CVE-2026-15457)

More from this source