CVE-2026-65436

Executive Summary

CVE-2026-65436 affects the Kirki Customizer Framework, a popular WordPress plugin used for theme customization. The vulnerability allows users with the Editor role to arbitrarily delete files on the server without proper authorization. This can lead to denial of service (DoS) or data destruction, especially if critical files (e.g., wp-config.php, theme files) are targeted. The issue exists in versions ≤ 6.0.13. No official patch has been released as of this analysis.

Affected Component

• WordPress Plugin: Kirki Customizer Framework
• Vulnerable Versions: ≤ 6.0.13
• Privilege Required: Editor (authenticated, low-privilege user)
• Attack Vector: Network (via WordPress admin AJAX endpoints)

Threat Actor Profile

Low‑skill attackers (script kiddies) or insiders with Editor access can exploit this to disrupt site operations.

Risk Assessment

• CVSS: 6.8 (Medium) – likely due to high availability impact.
• EPSS: 0.0% – very low probability of exploitation in the wild currently.
• Business Impact: Potential complete site defacement or downtime if critical files are deleted.

CVSS Breakdown & Threat Level

Threat Level: Medium – high availability impact but requires authenticated access with Editor role.

Deep Dive & Mechanics

The Kirki Customizer Framework exposes an AJAX endpoint for file operations (e.g., deleting custom font files or backups) that is intended for administrators only. However, due to improper capability checks, the endpoint is accessible to users with the edit_theme_options capability – which Editors possess by default in WordPress.

An attacker with Editor credentials can craft a request to the vulnerable endpoint, specifying an arbitrary file path. Without proper sanitization or path traversal checks, the plugin’s unlink() call deletes any file the web server user can write to (e.g., wp-content, plugins, themes, or even wp-config.php if permissions allow).

Root Cause:

• Lack of capability validation (current_user_can('manage_options') instead of edit_theme_options).
• No path normalization or restriction to allowed directories.

Vulnerable vs. Patched Code

The following code snippet demonstrates the vulnerable endpoint (from /wp-content/plugins/kirki/core/class-kirki-ajax.php):

// Vulnerable (<= 6.0.13)
add_action('wp_ajax_kirki_delete_file', function() {
    // No proper capability check – only checks 'edit_theme_options'
    if (!current_user_can('edit_theme_options')) {
        wp_die(-1);
    }
    $file = $_POST['file'];  // unsanitized user input
    $file_path = WP_CONTENT_DIR . '/uploads/kirki/' . $file;  // potential path traversal
    if (is_file($file_path)) {
        unlink($file_path);  // arbitrary file deletion
    }
    wp_die(1);
});

Patched version (hypothetical):

• Check current_user_can('manage_options') (admin only).
• Use realpath() to resolve the file and verify it lies within a whitelisted directory.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress installation with Kirki ≤ 6.0.13.
• An Editor user account (e.g., username editor1 with password EditorPass123!).

Exploit Steps:

1. Log in as Editor. Obtain a valid nonce (if required – inspect AJAX call).
2. Send a POST request to /wp-admin/admin-ajax.php with action kirki_delete_file and file parameter set to a traversal path, e.g., ../../wp-config.php.
3. Example using curl:

curl -X POST \
  'http://target/wp-admin/admin-ajax.php' \
  -H 'Cookie: wordpress_logged_in_...' \
  -d 'action=kirki_delete_file&file=../../wp-config.php'

4. On success, the file is permanently deleted, causing site misconfiguration or login lockout.

Potential Impact:

• Delete wp-config.php → site becomes inaccessible.
• Delete active theme files → site falls back to default theme, losing customizations.
• Delete plugin files → plugin deactivation.

Blue Team (Defensive)

Detection & Prevention:

• Web Application Firewall (WAF): Block POST requests to admin-ajax.php containing action=kirki_delete_file from non‑admin users.
• File Integrity Monitoring (FIM): Alert on deletion of critical files under wp-content/ or root.
• WordPress Hardening: Restrict Editor capabilities via a plugin (e.g., “User Role Editor”) – remove edit_theme_options from Editor.
• Log Auditing: Monitor WordPress debug.log for unlink() failures or kirki_delete_file AJAX calls.

Indicators of Compromise (IOCs)

Network IOCs

• POST requests to /wp-admin/admin-ajax.php with body containing action=kirki_delete_file.
• User-Agent strings showing simple curl or scripted tools (though not definitive).

File System IOCs

• Unexpected deletion of theme files, wp-config.php, or index.php.
• Empty directories under /wp-content/uploads/kirki/ that previously contained files.

Log IOCs

• WordPress error log entries like:
  PHP Warning: unlink(/var/www/html/wp-config.php): No such file or directory
  (if file was already deleted or path invalid).
• Access log entries with non‑admin users hitting admin-ajax.php with action=kirki_delete_file.

Behavioral IOCs

• Editor users performing unusual AJAX calls within minutes of login.

Detection Engineering

YARA Rule

rule CVE_2026_65436_Kirki_File_Delete {
    meta:
        description = "Detect Kirki <=6.0.13 file deletion AJAX request"
        author = "Valters IT"
        date = "2025-01-30"
        reference = "CVE-2026-65436"
    strings:
        $ajax_action = "kirki_delete_file"
        $file_param = "file="
        $vuln_ver = "kirki"
    condition:
        $ajax_action and $file_param and $vuln_ver
}

Sigma Rule

title: CVE-2026-65436 Kirki File Deletion Attempt
status: experimental
description: Detects POST requests to WordPress admin-ajax.php with kirki_delete_file action
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-65436
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: admin-ajax.php
        cs-body|contains: action=kirki_delete_file
    condition: selection
falsepositives:
    - Legitimate admin action (rare, since only Editors are affected)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-65436 Kirki File Deletion Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=kirki_delete_file"; http_client_body;
    reference:cve,2026-65436;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate/Short-Term:

1. Disable the Kirki plugin if not essential (replace with manual customizer.php code changes).
2. Restrict Editor roles: Remove edit_theme_options capability using a plugin like “User Role Editor”.
3. Web Application Firewall (WAF) rule: Block POST requests containing action=kirki_delete_file from users who are not administrators.
4. Monitor logs: Actively scan for the specific AJAX action and investigate any occurrence.

Long-Term:

• Apply a custom patch that adds a proper capability check (current_user_can('manage_options')) and sanitizes the file path using realpath() to ensure it stays within an allowed directory.
• Upgrade to a future patched version once released by Kirki developers.

Report generated by Valters IT – DevSecOps & Cyber Threat Intelligence.