The Kirki plugin for WordPress suffers from a directory traversal flaw, where the 'data' parameter is processed without proper validation. By crafting a URL that includes the uploads path as a substring and embedding traversal sequences such as /wp-content/uploads/../../wp-config.php, the built‑in guard is bypassed. This flaw allows an authenticated attacker with editor‑level access or higher to read the contents of arbitrary files on the server, potentially exposing sensitive configuration data and credentials.

The vulnerability exists in all releases of the Themeum Kirki plugin up to and including version 6.1.1. Administrators of WordPress sites that employ these versions are affected.

The CVSS score of 4.9 indicates moderate severity. Exploitation requires valid authentication as an editor or higher, but once authenticated the attacker can read any file on the server path the plugin can reach. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Because the flaw is authenticated, the attack surface is limited to users who already have content‑editor privileges, yet the possible leak of configuration files represents a non‑trivial risk for confidentiality.