CVE-2026-17604

Executive Summary

CVE-2026-17604 is a directory traversal vulnerability (CWE-22) in the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress, affecting all versions up to and including 6.1.1. Authenticated attackers with editor-level access or above can exploit an insufficient substring-based guard on the 'data' parameter to read arbitrary files on the server, including sensitive files such as wp-config.php, which exposes database credentials and application secrets. The vendor has not released a patch (confidence 0/4), and no public exploit, Nuclei template, in-the-wild campaign, or CISA KEV listing has been identified at the time of writing.

Technical Analysis

The vulnerability is a classic path traversal / directory traversal flaw in the file-handling logic of the Kirki WordPress plugin. According to the NVD description, the plugin reads a file whose location is supplied through the 'data' parameter. The developer attempted to constrain file access to the WordPress uploads directory by using a strpos()-based check: the code verifies that the user-supplied path contains the uploads base path as a substring before allowing the read operation to proceed.

This protection is logically flawed. strpos() only confirms that a substring exists somewhere in the string; it does not verify that the canonicalized (resolved) path remains inside the intended directory. An attacker can therefore supply a path such as:

/wp-content/uploads/../../wp-config.php

Because the string /wp-content/uploads/ appears at the beginning of the value, the strpos() guard passes. However, when the operating system resolves the path, the ../ traversal sequences cancel out the uploads directory component and traverse upward to the WordPress root, where wp-config.php resides. The mismatch between the raw-string check (which sees a "safe" prefix) and the filesystem resolution (which follows the traversal sequences) is the root cause of the bypass.

Key technical characteristics derived from the available data:

• Affected component: Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress, all versions <= 6.1.1.
• Vulnerable parameter: 'data'.
• Access requirements: Authenticated, editor-level role or higher. This is not an unauthenticated vulnerability; the attacker must already hold a WordPress account with at least editor privileges.
• Impact primitive: Arbitrary file read on the server, limited only by the privileges of the web server process (typically www-data on Linux or the IIS application pool identity on Windows). The NVD description explicitly notes that the read files "can contain sensitive information."
• Weather the guard: strpos()-based substring containment check bypassed by embedding the uploads base path plus ../ traversal sequences.
• CVSS: 4.9 — Medium severity. Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. The high privilege requirement (editor) suppresses the raw score, but confidentiality impact is high. Integrity and availability are unaffected per the vector.
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

No further implementation details — such as specific function names, class names, or the exact URL endpoint that processes the 'data' parameter — are disclosed in the NVD description. The analysis above is grounded strictly in the description text. EPSS has not yet been scored by FIRST.org, so no exploit-probability score is available. Patch confidence is 0/4, meaning no tracked source (vendor advisory, git commit, changelog, or security announcement) confirms a fix.

Exploitation Scenarios

No public PoC is available, so the following attack chain is inferred from the vulnerability class and the NVD description. The steps describe the expected real-world exploitation flow.

1. Reconnaissance / target identification. The attacker targets WordPress sites running the Kirki – Freeform Page Builder, Website Builder & Customizer plugin. This may be performed by fingerprinting the deployed plugin (e.g., via publicly accessible plugin assets or version disclosure) or by scanning for sites whose behavior/content indicates use of the builder. Critically, the attacker must first obtain or already possess a WordPress account with editor-level privileges. Acquisition vectors include credential stuffing, phishing, reused passwords, or lateral movement from a compromised lower-privilege account.

2. Triggering the flaw. With editor access, the attacker identifies the plugin functionality that accepts the 'data' parameter. A crafted HTTP request is constructed in which the 'data' parameter is set to a path that includes the uploads base path as a substring while also embedding directory traversal sequences — for example, /wp-content/uploads/../../wp-config.php, the exact payload pattern cited in the NVD description. The strpos()-based check sees the /wp-content/uploads/ prefix and approves the path, since the uploads substring is present.

3. Payload / execution mechanism. The plugin passes the attacker-controlled path to a server-side file-read operation. During path resolution, the ../ sequences navigate upward from the uploads directory to the WordPress installation root. The content of the requested file is then returned to the authenticated attacker. While wp-config.php is the canonical high-value target, any file readable by the web server user is potentially exposed — including .env files, backup archives, other configuration files, and cached content. It is acceptable to note that the precise read mechanism inside the plugin is undisclosed; the attack is driven entirely by the flawed substring check.

4. Post-exploitation impact. The most immediate prize is wp-config.php, which contains the WordPress database host, database name, database credentials, authentication salts, and secret keys. With these, the attacker can connect directly to the MySQL database, create or modify administrative accounts, inject persistent backdoors, exfiltrate user data, and potentially pivot to other systems if database credentials are reused elsewhere. In shared-hosting environments, the disclosed credentials or readable files may also reveal access to adjacent customer accounts. The read primitive itself is high-impact, but it is the credential-disclosure cascade that elevates the severity of the vulnerability in practice.

No evidence of active exploitation, exploit-in-the-wild activity, or known threat actor campaigns exists in the provided data. The lack of a patch and the low complexity of the bypass mean that weaponization is straightforward for any attacker who obtains editor-level credentials.

Impact Assessment

• CVSS analysis (4.9, Medium): The confidentiality impact is rated High (C), while integrity and availability are rated None. The attack vector is Network, and attack complexity is Low. The High privilege requirement reflects the editor-level authentication needed, and no user interaction is required. The scope is unchanged — the affected component is the WordPress application itself.
• Affected systems: Any WordPress installation running the Kirki plugin at version 6.1.1 or earlier. Because many WordPress sites maintain multiple editor-level accounts (agencies, content teams, guest authors promoted to editor), the effective authentication barrier is often lower than it appears — the compromise of a single editor account is sufficient.
• Business impact: Disclosure of source code and configuration secrets. In WordPress, wp-config.php is the single most sensitive file; its exposure leads directly to database takeover. Full WordPress compromise can result in defacement, malware distribution to site visitors, SEO spam, ransomware, and the use of the compromised host as a pivot point. For businesses relying on WooCommerce or membership plugins, customer PII and payment-related data stored in the database may also be at risk.
• Blast radius: The vulnerability is self-contained to the WordPress application file system, but the leakage of database credentials expands the blast radius to the entire database server and any co-located applications using the same credentials. In managed WordPress environments, a compromised site may share infrastructure with other tenants, increasing the potential for cross-tenant impact.
• Exploitability consideration: Although no public PoC exists as of this report, the traversal bypass is conceptually trivial — a single crafted HTTP request against the 'data' parameter. The absence of a patch (0/4 confidence) means every affected site is indefinitely exposed until mitigations are applied manually.

Detection Guidance

The following detection content is designed to identify attempt patterns consistent with CVE-2026-17604 exploitation. The canonical detection characteristic is an HTTP request containing both /wp-content/uploads/ and ../ traversal sequences in the 'data' parameter (URL-encoded or raw). Detection rules should be tuned to the local environment and validated against normal plugin behavior.

Sigma Rule

title: WordPress Kirki Plugin Directory Traversal Attempt (CVE-2026-17604)
id: 5b8d2f24-9e4c-4c1a-8f3a-2e6d1c9b0a11
status: experimental
description: Detects HTTP requests to WordPress containing directory traversal sequences in the data parameter combined with the wp-content/uploads base path, consistent with CVE-2026-17604.
author: ValtersIT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_uploads:
    cs-uri-query|contains:
      - "wp-content/uploads"
      - "wp-content%2fuploads"
  selection_traversal:
    cs-uri-query|contains:
      - "..%2f"
      - "../"
      - "%2e%2e%2f"
  selection_data_param:
    cs-uri-query|contains:
      - "data="
  condition: all of selection_*
falsepositives:
  - Legitimate plugin functionality referencing uploads paths with traversal (unlikely; verify against baseline)
level: high
tags:
  - attack.t1190
  - attack.t1005
  - cve.2026.17604
  - cwe.22

YARA Rule

rule wp_kirki_dir_traversal_cve_2026_17604
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects strings indicative of CVE-2026-17604 directory traversal in WordPress HTTP requests or logs"
        reference = "CVE-2026-17604"
        cve = "2026-17604"
        date = "2026-01-01"
        severity = "high"
    strings:
        $a = "wp-content/uploads" ascii wide nocase
        $b = "wp-content%2fuploads" ascii wide nocase
        $c = "../../" ascii
        $d = "..%2f" ascii nocase
        $e = "%2e%2e%2f" ascii nocase
        $f = "data=" ascii nocase
        $g = "wp-config.php" ascii wide nocase
    condition:
        uint16(0) == 0x0a0d or uint16(0) == 0x0d0a or filesize < 10MB
        and ($f) and (any of ($a,$b)) and (any of ($c,$d,$e)) and ($g)
}

Note: The rule condition assumes scanning captured HTTP traffic, raw request buffers, or web server access logs. Adjust the header/file-size checks to the data source in use.

Suricata IDS Rule

alert http any any -> any any (msg:"ET WEB_SERVER WordPress Kirki Plugin Directory Traversal Attempt (CVE-2026-17604)"; flow:established,to_server; content:"data="; http_uri; content:"wp-content/uploads"; http_uri; nocase; content:"../"; http_uri; distance:0; classtype:attempted-recon; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-17604; reference:cve,2026-17604; sid:202617604; rev:1;)

Note: The rule intentionally focuses on the raw ../ pattern in the URI combined with the uploads path and the 'data' parameter. For URL-encoded variants, add a second rule matching ..%2f or %2e%2e%2f. Verify and assign a SID appropriate to your rule management process.

Elastic Detection

any where event.category == "web" and network.protocol == "http"
    and url.path like "*wp-content/uploads*"
    and url.path like "*../*"
    and url.query like "*data=*"

Splunk SPL Query

index=web sourcetype=access_* (uri_path="*/wp-content/uploads/*" OR uri_path="*/wp-content%2fuploads/*")
    (uri_path="*../*" OR uri_path="*..%2f*" OR uri_path="*%2e%2e%2f*")
    uri_query="*data=*"
| stats count min(_time) max(_time) values(uri) AS requested_uri values(src_ip) AS source_ips by host, status
| sort - count

Wazuh OSSEC Rule

<group name="web-access,attack,">
  <rule id="100176" level="12" frequency="5" timeframe="60">
    <if_sid>31100,31101,31102</if_sid>
    <regex>/(wp-content/uploads|wp-content%2fuploads).*\.\./|/(wp-content/uploads|wp-content%2fuploads).*(\.\.%2f|%2e%2e%2f)</regex>
    <description>Possible directory traversal in WordPress Kirki plugin data parameter (CVE-2026-17604)</description>
    <options>no_full_log</options>
    <group>web-access,attack,pci_dss_6.5,cwe_22,</group>
  </rule>
</group>

Note: This rule is intended to append to a standard Apache/Nginx web-access decoder chain (sample if_sid values shown; adjust to match your local parent rules). The frequency threshold suppresses single-scan noise while alerting on repeated traversal attempts.

Mitigation & Patch Guidance

Patch confidence is 0/4 — the vulnerability is currently UNPATCHED. No vendor fix, patched version, or official workaround was identified from any tracked source. Treat all versions up to and including 6.1.1 as vulnerable until a fixed release is verified.

1) Immediate mitigations (apply today):

• Limit editor-level accounts. Audit all WordPress users with editor, administrator, and super-admin roles. Remove or demote accounts that do not strictly require those privileges. Enforce strong, unique passwords and multi-factor authentication (MFA) for all privileged accounts.
• Deploy a WAF virtual patch. If a web application firewall or reverse proxy is in place, add rules that block requests where the 'data' parameter contains ../, ..%2f, or %2e%2e%2f sequences, particularly when combined with /wp-content/uploads/. Also block requests where wp-config.php appears in the query or URI origin.
• Monitor and alert. Enable the detection rules above on web server access logs. Alert on repeated traversal patterns from the same source IP or authenticated user.
• Consider disabling the plugin. If the Kirki builder is not business-critical, disable and remove it until a patch is available. If it is critical, restrict access to the WordPress admin backend via network-level allowlisting where feasible.
• Rotate secrets preemptively. If there is any indication of compromise, rotate WordPress database credentials, authentication salts, and any credentials that may be present in readable configuration files.

2) Patch / upgrade steps:

• Monitor the plugin's official update channel, the WordPress plugin directory, and vendor security advisories for a version greater than 6.1.1.
• Test and deploy the patched version as soon as it is released. Because no patch exists today, schedule recurring checks and subscribe to vulnerability alert feeds.
• If a patched version is released, follow a staged rollout: staging → non-production → production, with a rollback plan.

3) Long-term hardening:

• Apply the principle of least privilege across all WordPress roles and hosting accounts. Restrict file-system permissions so the web server user can read only what is necessary.
• Implement file integrity monitoring for critical files such as wp-config.php, .htaccess, and plugin directories.
• Rotate database and hosting credentials periodically and after any suspected exposure.
• Harden the WordPress installation: keep WordPress core, themes, and plugins updated; remove unused plugins; disable file editing; and use a security plugin that monitors failed logins and file changes.
• Segment the database server from the web server where architecture permits, and ensure database credentials are unique per application.
• Maintain an up-to-date inventory of all WordPress plugins and versions to rapidly identify exposure to newly disclosed vulnerabilities.

References

• NVD entry for CVE-2026-17604: https://nvd.nist.gov/vuln/detail/CVE-2026-17604
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• MITRE ATT&CK — T1005 Data from Local System: https://attack.mitre.org/techniques/T1005/
• OWASP Path Traversal reference: https://owasp.org/www-community/attacks/Path_Traversal

No vendor advisory, researcher publication, known threat-actor campaign, or exploit-in-the-wild evidence was identified in the provided data as of the report date. CVE-2026-17604 is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS has not yet been scored by FIRST.org, and no public PoC or Nuclei template is available. The information in this report is derived strictly from the NVD description and CVE metadata; due to sparse disclosure of implementation details, certain technical specifics (e.g., the exact URL endpoint processing the 'data' parameter) remain unknown and should be validated against the plugin source code by the reader.