The vulnerability in the Kirki WordPress plugin allows an authenticated user with editor level or higher access to perform a path traversal exploit, also known as Zip Slip. The flaw resides in the extract_zip_file function which accepts an unvalidated ZIP file path. An attacker can supply a crafted ZIP archive containing path‑traversal entry names that are extracted outside the intended directory, enabling arbitrary file write on the server, thereby creating the possibility for remote code execution. The weakness is categorized as CWE-22 – Path Traversal.

All installations of the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress with versions up to and including 6.0.13 are affected. The vulnerability is present in all major code paths that handle app installation, updating, and template retrieval from ZIP sources within these releases.

The CVSS score of 4.9 rates the vulnerability as moderate severity, while the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. Because the exploit requires authenticated access with editor or higher privileges, the attack surface is confined to users who are logged in and granted the requisite capabilities. The vulnerability is not listed in the CISA KEV catalog, thus no active exploit data is reported as of now. Attackers would need to combine privilege exploitation with ZIP‑based file inclusion to achieve arbitrary file writes, which could lead to remote code execution if critical files are overwritten or malicious payloads are injected.