CVE-2026-15601

🗓️ 01 Aug 2026 07:49:46Reported by WordfenceType

Kirki <=6.0.13 enables authenticated editors to write arbitrary files via ZIP path traversal during extraction.

Reporter	Title	Published	Views	Family All 4
ATTACKERKB	CVE-2026-15601	1 Aug 202607:49	–	attackerkb
Cvelist	CVE-2026-15601 Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)	1 Aug 202607:49	–	cvelist
EUVD	EUVD-2026-51745	1 Aug 202607:49	–	euvd
NVD	CVE-2026-15601	1 Aug 202609:16	–	nvd

Vulners

Node

themeum kirki_freeform_page_builder,_website_builder_&_customizerRange≤6.0.13wordpress

[
  {
    "vendor": "themeum",
    "product": "Kirki – Freeform Page Builder, Website Builder & Customizer",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "6.0.13",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/routes/api.php
plugins	www.plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/includes/Ajax/Apps.php
plugins	www.plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/app/Services/AppsService.php
plugins	www.plugins.trac.wordpress.org/browser/kirki/tags/6.0.13/routes/api.php
plugins	www.plugins.trac.wordpress.org/browser/kirki/tags/6.0.13/app/Supports/FileHandler.php
plugins	www.plugins.trac.wordpress.org/browser/kirki/tags/6.0.13/app/Http/Controllers/Api/AppsController.php
plugins	www.plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/app/Supports/FileHandler.php
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/app/Http/Controllers/Api/AppsController.php
plugins	www.plugins.trac.wordpress.org/browser/kirki/tags/6.0.13/includes/Ajax/Apps.php

01 Aug 2026 09:16Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.14.9

EPSS0.00767

CWE-22