CVE-2026-15601 describes a path traversal vulnerability (CWE-22) in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin. Versions up to and including 6.0.13 are affected. The vulnerability arises from insufficient sanitization of ZIP file entry names in the extract_zip_file function, which is used by install_app, update_app, and get_kirki_template_from_zip. Authenticated attackers with custom-level privileges or higher can supply a crafted ZIP file containing path-traversing entries, enabling arbitrary file writes outside the intended directory. This can lead to remote code execution. The CVSS v3.1 base score is 4.9 (medium severity), with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No vendor advisory or patch is currently available, and no known exploits in the wild have been reported.

An authenticated attacker with custom-level access or higher can exploit this vulnerability to write arbitrary files on the server by uploading crafted ZIP files that traverse directories during extraction. This unauthorized file write can lead to remote code execution, compromising the server's confidentiality and potentially allowing further attacks. The integrity and availability impacts are not indicated. The vulnerability requires network access and elevated privileges, limiting the attack surface to authenticated users with sufficient permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to users with custom-level privileges or higher and monitor for suspicious activity related to ZIP file uploads. Avoid using the affected plugin versions or disable the plugin if possible to mitigate risk.