Description

The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored XSS as well as RCE on some server configurations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-20T06:17:19.360Z",
  "pubdate": "2026-08-20T06:17:19.360Z",
  "executiveSummary": "The Kirki WordPress plugin is affected by an arbitrary file upload vulnerability leading to Stored Cross-Site Scripting (XSS) and Remote Code Execution (RCE).\nThe flaw stems from insufficient validation of files contained within archives uploaded by authenticated users, specifically those assigned the Editor role.\nUpon extraction of the user-supplied archive, the application fails to adequately sanitize or remove unwanted files, leaving them persisted within a web-accessible directory.\nAn authenticated attacker possessing the Editor role can leverage this capability to upload and execute malicious payloads, thereby compromising the underlying server configuration and executing arbitrary code within the context of the web server.\nThe risk implications are critical, as successful exploitation enables full system compromise and unauthorized code execution.\nExploitation requires authenticated access with the Editor privilege level.",
  "technicalDetails": "The root cause of the vulnerability resides in the archive handling functionality of the Kirki WordPress plugin, which processes user-uploaded compressed files.\nSpecifically, the component fails to properly validate the internal file types and contents of archives submitted by users.\nFurthermore, the cleanup mechanism fails to purge unwanted or dangerous files after the extraction process completes.\nThe vulnerable component is accessible to authenticated users with the Editor role, exposing the application to privilege abuse.\nThe attack flow proceeds as follows: First, the attacker authenticates to the WordPress administration panel with Editor privileges. Second, the attacker crafts a malicious archive containing unauthorized files, such as PHP webshells or HTML documents containing malicious scripts. Third, the attacker uploads the archive through the vulnerable Kirki plugin functionality. Fourth, the application extracts the archive contents into a web-accessible directory on the server. Fifth, because the system does not properly validate or remove unwanted files post-extraction, the malicious payloads remain accessible via direct HTTP requests. Sixth, the attacker executes the uploaded arbitrary files, resulting in Stored XSS via malicious script execution or Remote Code Execution (RCE) depending on the server configuration and the execution of uploaded script files.\nThe affected versions include the Kirki WordPress plugin prior to version 6.2.3."
}