CVE-2026-15601 describes a path traversal (Zip Slip) vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin. The issue affects all versions up to and including 6.0.13. The vulnerability exists in the extract_zip_file function, which is called by install_app, update_app, and get_kirki_template_from_zip code paths. These functions accept a user-supplied app source URL to download and extract ZIP files. Due to lack of sanitization on ZIP entry names, an authenticated attacker with custom-level access or higher can craft ZIP files containing path-traversing entries that write files outside the intended directory. This can lead to arbitrary file write and potentially remote code execution. The CVSS 3.1 base score is 4.9 (medium severity), with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact. No official patch or remediation level is currently indicated in the vendor or advisory data.

An authenticated attacker with custom-level access or higher can exploit this vulnerability to write arbitrary files on the server by uploading specially crafted ZIP files. This arbitrary file write can lead to remote code execution, compromising the confidentiality of the system. The vulnerability does not impact integrity or availability directly but poses a significant confidentiality risk. The attack requires network access and elevated privileges (custom-level or higher).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to users with custom-level privileges or higher and monitor for suspicious ZIP file uploads. Avoid using untrusted ZIP files for installation or updates. Follow vendor communications for updates on patches or official mitigations.