The vulnerability arises from insufficient validation of file paths in the downloadZIP routine, allowing the construction of file names that reference any file within the WordPress uploads directory. An attacker can read file contents and delete files without authentication, potentially destroying site data, exposing sensitive files, or facilitating further attacks. The weakness is a Path Traversal flaw (CWE-23).

Kirki – Freeform Page Builder, Website Builder & Customizer, versions 6.0.6 and earlier.

The CVSS score is 7.5, indicating a high severity. EPSS is not available, so the exact likelihood of exploitation in the wild is uncertain, but the lack of authentication and file system constraints make exploitation relatively straightforward for an attacker with network access to the WordPress instance. The vulnerability is not listed in the CISA KEV catalog, yet its impact on data integrity and availability warrants prompt action. Based on the description, it is inferred that the attack vector is over the network via HTTP requests to the affected plugin endpoint; authentication checks are missing, so any visitor can exploit the flaw.