PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8073 themeum CVE debrief

CVE-2026-8073 is a high-severity flaw in the Kirki WordPress plugin that can let an unauthenticated attacker trigger arbitrary file deletion, with the impact limited to paths under the WordPress uploads base directory. The issue is tied to insufficient file path validation and a missing capability check in the downloadZIP function. NVD lists the vulnerability as deferred, while Wordfence references the affected code location and a later changeset in the WordPress plugin repository.

Vendor
themeum
Product
Kirki – Freeform Page Builder, Website Builder & Customizer
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-07-24
Advisory published
2026-05-19
Advisory updated
2026-07-24

Who should care

WordPress site owners and administrators running the Kirki – Freeform Page Builder, Website Builder & Customizer plugin, especially any site still on version 6.0.6 or earlier. Teams responsible for WordPress plugin patching, media/uploads workflows, and site integrity monitoring should prioritize this advisory.

Technical summary

The supplied NVD record describes CVE-2026-8073 as an arbitrary file deletion issue in Kirki caused by insufficient file path validation and a missing capability check in downloadZIP. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, reflecting network-reachable, unauthenticated impact. Wordfence’s references point to the affected plugin file and a later changeset in the WordPress plugin repository, indicating the issue was addressed in source control. The described impact is constrained to the WordPress uploads base directory, but the ability to delete files without authentication is still operationally significant.

Defensive priority

High

Recommended defensive actions

  • Upgrade Kirki to a version newer than 6.0.6 from the official plugin distribution channel as soon as a fixed release is available.
  • If you cannot confirm a safe version, temporarily disable or remove the plugin until you can verify remediation.
  • Review WordPress uploads-related file integrity and recent deletion activity for unexpected changes.
  • Validate that plugin update and file permissions controls are in place so unauthenticated requests cannot reach file-handling logic.
  • Track the official WordPress plugin repository and the Wordfence advisory for the remediation details and any follow-up notices.

Evidence notes

All claims here are limited to the supplied corpus and official links. The NVD record cites Wordfence as the source of the vulnerability details, including CWE-23, the affected file reference in plugins.trac.wordpress.org, and a repository changeset. The provided CVSS vector supports a network-exploitable, unauthenticated condition. Vendor attribution is uncertain in the supplied metadata, so the debrief treats Kirki as the affected product and WordPress/plugin distribution as the relevant ecosystem.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8073 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8073

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8073 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8073

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.