CVE-2026-15457

🗓️ 17 Jul 2026 03:43:40Reported by WordfenceType

Authenticated editors can traverse directories via the family parameter in Kirki up to version six point zero thirteen, enabling arbitrary deletion.

Reporter	Title	Published	Views	Family All 5
ATTACKERKB	CVE-2026-15457	17 Jul 202603:43	–	attackerkb
Cvelist	CVE-2026-15457 Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter	17 Jul 202603:43	–	cvelist
EUVD	EUVD-2026-45131	17 Jul 202603:43	–	euvd
NVD	CVE-2026-15457	17 Jul 202605:16	–	nvd
Positive Technologies	PT-2026-60711	17 Jul 202600:00	–	ptsecurity

Vulners

Node

themeum kirki_freeform_page_builder,_website_builder_&_customizerRange≤6.0.13wordpress

[
  {
    "vendor": "themeum",
    "product": "Kirki – Freeform Page Builder, Website Builder & Customizer",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "6.0.13",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/kirki/tags/6.0.13/app/Services/FontService.php
plugins	www.plugins.trac.wordpress.org/browser/kirki/tags/6.0.13/app/Http/Controllers/Api/GlobalDataController.php
plugins	www.plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/includes/Ajax/Media.php
plugins	www.plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/routes/api.php
plugins	www.plugins.trac.wordpress.org/browser/kirki/tags/6.0.13/routes/api.php
plugins	www.plugins.trac.wordpress.org/browser/kirki/tags/6.0.13/includes/Ajax/Media.php
plugins	www.plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/app/Http/Controllers/Api/GlobalDataController.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/01a52285-2d0c-4b29-8dab-18a3e3640e5c
plugins	www.plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/app/Services/FontService.php
plugins	www.plugins.trac.wordpress.org/changeset

17 Jul 2026 05:16Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.14.9

CWE-22