The Kirki plugin for WordPress permits a user with editor rights to delete arbitrary files on the server through its editor interface. This flaw allows attackers to remove critical files, potentially disabling site functionality or deleting sensitive data. The vulnerability is a classic path traversal and improper access control issue, classified as CWE‑22, which can lead to data loss and site compromise.

Vulnerable instances are WordPress sites that have installed the Themeum Kirki plugin version 6.0.13 or earlier. Any deployment of this plugin in those versions, regardless of the host environment, is at risk until an update is applied.

The CVSS score of 6.8 indicates moderate severity, and the EPSS score is 0.00325, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation reports yet. Likely exploitation requires an authenticated editor or higher‑privileged user on the site, so internal threat actors or compromised credentials pose the greatest risk. Since the flaw stems from a missing input validation check, a malicious user could delete files without direct code execution.