CVE-2026-8073 is a relative path traversal vulnerability (CWE-23) in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin. The issue arises from inadequate validation of file paths and absence of capability checks in the 'downloadZIP' function, enabling unauthenticated attackers to read and delete arbitrary files limited to the WordPress uploads directory. This vulnerability affects all versions up to and including 6.0.6. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network exploitable with low attack complexity, no privileges or user interaction required, and high impact on confidentiality but no impact on integrity or availability. No patch or official remediation level has been disclosed by the vendor as of the published date.

An unauthenticated attacker can exploit this vulnerability to read and delete arbitrary files within the WordPress uploads directory. This can lead to unauthorized disclosure of sensitive files and potential disruption of website content or functionality by deleting files. The impact is limited to the uploads base directory and does not extend to other parts of the system. There are no known active exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin or disabling it if feasible. Monitor official themeum communications and WordPress plugin repositories for updates. Avoid exposing the uploads directory to untrusted users and consider additional access controls as a temporary measure.