Description

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The intended strpos()-based guard against leaving the uploads directory is bypassed by crafting a URL that includes the uploads base path as a substring while embedding directory traversal sequences, such as /wp-content/uploads/../../wp-config.php.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-16T07:16:30.547Z",
  "pubdate": "2026-08-16T07:16:30.547Z",
  "executiveSummary": "The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to an authenticated Directory Traversal vulnerability across all versions up to, and including, 6.1.1. This security flaw originates from insufficient input sanitization and a flawed string position validation mechanism within the data parameter handling routine.\nSuccessfully exploiting this vulnerability allows authenticated attackers with editor-level access or higher to perform arbitrary file read operations on the underlying web server. This exposure can lead to the unauthorized retrieval of highly sensitive system files, including core configuration files containing database credentials and cryptographic keys.\nThe root cause is a bypassable strpos()-based security guard intended to restrict file access strictly to the designated uploads directory. Attackers can subvert this control by engineering a specifically crafted request path that satisfies the substring match while simultaneously incorporating directory traversal sequences, such as /wp-content/uploads/../../wp-config.php.\nThe risk implication is severe, as compromise of sensitive configuration files often leads to complete administrative takeover of the WordPress installation or lateral movement within the hosting infrastructure. Remediation requires updating the plugin once a secure patch is made available by the vendor or restricting editor-level privileges until an update can be applied.",
  "technicalDetails": "The vulnerability resides within the file processing logic of the Kirki – Freeform Page Builder, Website Builder & Customizer plugin, specifically affecting all versions up to, and including, 6.1.1. The flaw is triggered via the untrusted 'data' parameter, which fails to properly validate or sanitize file paths before processing read operations on the server filesystem.\nThe root cause of the vulnerability is a flawed validation implementation utilizing the PHP strpos() function. The developers attempted to enforce a strict boundary check to ensure that all requested file paths originate exclusively from within the legitimate WordPress uploads directory. However, strpos()-based checks are notoriously prone to logical bypasses when handling relative path notation and boundary conditions.\nAn authenticated attacker possessing editor-level access or above can exploit this flaw by constructing a malicious input string passed through the 'data' parameter. The attack flow involves crafting a specialized URL payload that incorporates the legitimate uploads base path as a required substring to satisfy the naive strpos() conditional check. Immediately preceding or embedded within this structure, the attacker appends directory traversal sequences, such as ../, allowing the file handler to escape the intended directory boundary.\nFor example, by submitting a payload structured like /wp-content/uploads/../../wp-config.php, the path validation logic successfully detects the presence of the uploads base path substring and evaluates the request as safe. Subsequently, the underlying file retrieval routines execute the traversal sequence, resolving the path outside the intended directory context and granting read access to arbitrary system files located elsewhere in the directory tree.\nThe post-exploitation impact includes the disclosure of sensitive configuration files, internal application source code, and environment variables. Attackers can leverage the contents of files like wp-config.php to harvest database connection strings, authentication salts, and other privileged credentials, severely compromising the confidentiality and integrity of the affected WordPress environment."
}