CVE-2026-8073 is a relative path traversal vulnerability (CWE-23) in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin. The issue arises from inadequate validation of file paths and lack of capability checks in the 'downloadZIP' function, enabling unauthenticated attackers to read and delete arbitrary files limited to the WordPress uploads directory. This vulnerability affects all versions up to and including 6.0.6. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No official fix or patch has been documented in the vendor advisory or other sources.

An unauthenticated attacker can exploit this vulnerability to read and delete arbitrary files within the WordPress uploads directory. This could lead to loss of user-uploaded content or exposure of sensitive files stored in that directory. The confidentiality impact is high, but integrity and availability impacts are not indicated. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the uploads directory and monitor for suspicious activity related to file deletions. Avoid exposing the vulnerable plugin on publicly accessible sites if possible. Do not rely on generic mitigations; follow vendor updates closely.