CVE-2026-17604 is a directory traversal vulnerability (CWE-22) in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin. The flaw exists in the handling of the 'data' parameter, where the plugin attempts to restrict file access to the uploads directory using a strpos()-based guard. However, this check can be bypassed by including the uploads base path as a substring combined with directory traversal sequences (e.g., /wp-content/uploads/../../wp-config.php). This allows authenticated users with editor-level access or higher to read arbitrary files on the server, potentially exposing sensitive information. The vulnerability affects all plugin versions up to and including 6.1.1. There is no vendor advisory or patch information available at this time.

Authenticated attackers with editor-level or higher privileges can read arbitrary files on the server, potentially exposing sensitive information such as configuration files. The vulnerability does not allow modification or deletion of files, nor does it affect availability. The CVSS v3.1 base score is 4.9 (medium severity), reflecting the confidentiality impact with no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict editor-level access to trusted users only and monitor for suspicious activity. Avoid exposing sensitive files in accessible directories. Do not rely solely on the plugin's current path validation mechanism as it can be bypassed.