CVE-2026-17604 is a directory traversal vulnerability (CWE-22) in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin affecting all versions up to 6.1.1. The issue is due to improper limitation of a pathname to a restricted directory via the 'data' parameter. Authenticated attackers with editor-level access or higher can bypass the strpos()-based check intended to restrict file access to the uploads directory by embedding directory traversal sequences such as '/wp-content/uploads/../../wp-config.php' in the URL. This allows reading arbitrary files on the server, potentially exposing sensitive information.

An attacker with editor-level or higher privileges can read arbitrary files on the server, which may include sensitive configuration files like wp-config.php. This can lead to exposure of sensitive data such as database credentials. The vulnerability does not allow code execution or denial of service but compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict editor-level access to trusted users only and monitor for suspicious activity related to file access. Avoid exposing sensitive files on the server and consider additional access controls at the server level to mitigate exploitation.