CVE-2026-74992

Executive Summary

CVE-2026-74992 is an arbitrary file upload vulnerability in the Kirki WordPress plugin (versions prior to 6.2.3). An authenticated attacker with the Editor role can upload crafted archive files that are not properly validated during extraction, leading to arbitrary file write to a web-accessible directory. The flaw results in Stored Cross-Site Scripting (XSS) and can escalate to Remote Code Execution (RCE) on server configurations where uploaded PHP or other executable files are processed. The vulnerability is currently unpatched with no vendor fix available, though the CVSS score of 6.8 indicates high confidentiality, integrity, and availability impact despite requiring Elevated privileges (Editor role) and user interaction.

Technical Analysis

The vulnerability exists within the Kirki WordPress plugin, which serves as a Customizer framework for themes. The plugin's archive-handling functionality fails in two distinct ways:

1. Insufficient archive validation: The plugin does not properly validate the contents of archive files (e.g., ZIP, TAR) uploaded by users assigned the Editor role. This means file type, extension, and path traversal checks are either absent or insufficiently enforced before, during, or after extraction.

2. Incomplete file cleanup post-extraction: After the extraction process completes, the plugin fails to remove all unwanted files. This implies that even if some validation heuristic flags malicious files, the removal logic is flawed — either it misses certain file types, fails to traverse nested directories, or leaves behind residual files that were processed before validation triggered.

The combination of these weaknesses permits Editor-level users to place arbitrary files — including PHP scripts, JavaScript files, or other web-executable content — into a web-accessible directory on the server. The attack surface is the WordPress administrative interface where Editors can access plugin functionality that handles archive uploads.

The vulnerability class is fundamentally an arbitrary file upload leading to stored XSS and potential RCE. The stored XSS vector is realized when an attacker uploads an HTML or JavaScript file that is later served to other users (including administrators), executing in their browser context. The RCE vector is realized when a PHP file is uploaded and subsequently executed via direct HTTP request, allowing the attacker to run arbitrary commands on the underlying server.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) indicates the attack can be performed remotely over the network (AV:N), requires low attack complexity (AC:L), demands elevated privileges in the form of the Editor role (PR:H), and requires user interaction (UI:R) — likely the administrator performing some action that triggers the malicious upload or content execution.

The CWE classification is CWE-79 (Cross-Site Scripting), though the root cause is more accurately a file upload vulnerability that manifests as XSS and RCE. The EPSS score of 0.00290 (21.6th percentile of exploited CVEs) suggests limited current exploitation activity, but the unpatched status elevates long-term risk.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and NVD description.

Step 1 — Reconnaissance/Target Identification: An attacker first identifies WordPress sites running the Kirki plugin. This can be accomplished via:

• WordPress plugin enumeration (e.g., checking /wp-content/plugins/kirki/ path)
• Shodan/Censys searches for WordPress installations
• Automated scanners looking for vulnerable plugin versions

Step 2 — Authentication and Privilege Establishment: The attacker requires a valid account with the Editor role. This could be obtained through:

• Compromised credentials (phishing, credential stuffing, password reuse)
• A previously compromised lower-privileged account that was escalated
• Social engineering targeting site administrators to create an Editor account

The Editor role is significant — it grants access to post editing and some plugin functionality, but not full administrative control, making this a realistic target for attackers who have compromised a mid-level account.

Step 3 — Malicious Archive Upload & Extraction: The attacker crafts a ZIP (or other archive format) file containing:

• A benign file (e.g., a legitimate image) to pass any initial visual inspection
• A malicious payload file — either a JavaScript file for stored XSS or a PHP webshell for RCE
• Possibly nested directories or obfuscated structures to bypass weak validation

The attacker uploads this archive through the vulnerable plugin interface. The plugin extracts the archive without properly validating file contents. Any file type checks can be evaded by crafting the archive so that malicious files are hidden within directory structures that bypass extraction-time validation, or by exploiting the incomplete cleanup mechanism — files that should be flagged and removed may remain on disk.

Step 4 — Payload Execution and Post-Exploitation: Two execution paths emerge:

• Stored XSS Path: The uploaded HTML/JavaScript file is stored in a web-accessible directory. When an administrator or other user navigates to that file's URL, the script executes in their browser. This can steal cookies, CSRF tokens, or perform administrative actions on behalf of the session, potentially leading to full admin account takeover.

• RCE Path (server-configuration dependent): The uploaded PHP file is accessible via a direct HTTP request to the web-accessible directory. The attacker sends a crafted request (e.g., GET /wp-content/uploads/evil.php with command parameters) which executes server-side, providing a foothold. Post-exploitation includes: server compromise, data exfiltration (critical: the CVSS CIA impact is High for all three), lateral movement into other hosted services, creation of additional backdoors, and potential pivot to the underlying infrastructure.

The user interaction requirement (UI:R) in the CVSS vector suggests that for the XSS path at minimum, some user action — such as an administrator visiting a crafted URL or the plugin page where the uploaded content is rendered — is required for the attack to fully succeed.

Impact Assessment

Business Impact:

• Confidentiality (High): Successful exploitation allows arbitrary file upload and access to web-accessible directories. In the RCE scenario, full server file reads are possible, exposing source code, configuration files, environment variables, and potentially customer data.
• Integrity (High): Arbitrary file upload directly compromises file system integrity. Attackers can modify existing files, inject malicious scripts, or plant webshells — all without proper authorization.
• Availability (High): An attacker with RCE can modify or delete critical application files, cause denial-of-service, or use the compromised host as a botnet node or for crypto-mining.

Affected Systems:

• WordPress installations running the Kirki plugin prior to version 6.2.3
• Server configurations where PHP execution from upload directories is enabled (common in default/Apache configurations)
• Any organization using themes that depend on the Kirki Customizer framework

Blast Radius:

• Direct compromise of the WordPress application and its hosting server
• Lateral movement potential into connected infrastructure (databases, adjacent services, storage)
• Supply-chain implications if the compromised site is a trusted third-party resource for other organizations
• Compliance and regulatory fallout (data breach notification obligations, GDPR/HIPAA/SOX implications depending on hosted data)
• Reputational damage and loss of customer trust

Rate:

• CVSS 6.8 (Medium) — this scoring is moderated by the requirement for Editor role privilege and user interaction, but the impact ratings (High/High/High) underscore that successful exploitation is devastating.
• The absence of a patch (patch confidence 0/4) raises the practical risk substantially — no remediation is currently available from the vendor.
• EPSS percentile of 21.6% indicates exploitation is not yet widespread, but the unpatched status may attract threat actor attention.

Detection Guidance

Sigma Rule

title: Kirki Plugin Arbitrary File Upload Attempt
id: 5f8a1c9e-3b2d-4e6f-8a1c-9e3b2d4e6f8a
status: experimental
description: Detects attempts to exploit CVE-2026-74992 by uploading archive files with suspicious content to Kirki plugin endpoints
author: Valtersit Threat Intelligence
date: 2026/01/15
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2026.74992
logsource:
  category: webserver
  product: apache
  definition: Detection is based on web server access logs that reveal WordPress admin uploads
detection:
  selection_backend:
    cs-method: 'POST'
    cs-uri-query|contains:
      - 'wp-admin/admin-ajax.php'
      - 'wp-admin/options.php'
      - 'wp-admin/upload.php'
  selection_wordpress:
    c-uri|contains: 'wp-content/plugins/kirki'
  selection_archive:
    cs-uri-query|contains:
      - '.zip'
      - '.tar'
      - '.gz'
      - '.rar'
      - '.7z'
  condition: selection_backend and selection_wordpress and selection_archive
falsepositives:
  - Legitimate theme/plugin administrators uploading valid archive files containing only theme assets
  - Development activities by site administrators
level: medium

YARA Rule

rule CVE_2026_74992_Kirki_Archive_Payload
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects archive files containing PHP or JavaScript payloads targeting Kirki plugin file upload vulnerability"
        date = "2026-01-15"
        reference = "CVE-2026-74992"
        severity = "high"

    strings:
        $php_payload = "<?php" ascii wide
        $php_short_tag = "<?=" ascii wide
        $js_payload = "<script>" ascii wide nocase
        $js_event = "onerror=" ascii wide nocase
        $js_eval = "eval(" ascii wide nocase
        $webshell = "system(" ascii wide nocase
        $webshell2 = "shell_exec(" ascii wide nocase
        $zip_magic = {50 4B 03 04}  // ZIP local file header
        $gzip_magic = {1F 8B}       // GZIP magic bytes

    condition:
        uint16(0) == 0x4B50 or uint16(0) == 0x8B1F and
        (any of them)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-74992 - Kirki Plugin Archive Upload with Suspicious Payload"; flow:to_server,established; content:"POST"; http_method; content:"wp-admin"; http_uri; content:"kirki"; http_uri; content:".zip"; http_uri; content:"?php"; http_client_body; nocase; reference:cve,2026-74992; classtype:web-application-attack; sid:10074992; rev:1;)

Elastic Detection

sequence by host.name with maxspan=1m
  [ process where event.type == "start" and process.name == "php-cgi" and process.args : "*upload*" ]
  [ file where event.type == "creation" and file.extension in ("php", "phtml", "php5", "php7", "js", "html") and file.path : "*wp-content*kirki*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="/wp-admin/*" AND uri_path="*kirki*" AND uri_path=("*.zip" OR "*.tar" OR "*.gz" OR "*.rar")
| stats count by src_ip, uri_path, http_method, status
| where count > 1
| table _time, src_ip, uri_path, http_method, count
| sort - count

Wazuh OSSEC Rule

<group name="wordpress,kirki,">
  <rule id="430802" level="10">
    <if_sid>31122</if_sid>
    <match>wp-admin</match>
    <match>kirki</match>
    <match>\.zip|\.tar|\.gz|\.rar</match>
    <description>CVE-2026-74992 - Kirki plugin archive upload with potential malicious payload detected</description>
    <group>attack.initial_access,attack.t1190</group>
    <info type="url">https://nvd.nist.gov/vuln/detail/CVE-2026-74992</info>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

No vendor fix exists as of this writing. The following are recommended actions:

1. Immediate Mitigations (while unpatched):

• Disable the archive upload feature for the Kirki plugin if a configuration option exists, or block file uploads through the plugin entirely using server-level access controls.
• Restrict Editor role permissions: Remove the upload_files capability for Editor users via a capability management plugin (e.g., User Role Editor) until the vulnerability is resolved.
• Disable PHP execution in upload directories: Configure the server to deny PHP execution within wp-content/uploads/ or other web-accessible directories where Kirki may extract files. For Apache, add .htaccess rules in upload directories disabling PHP handling; for Nginx, use location ~ \.php$ { deny all; } within upload path.
• Implement a WAF rule that blocks archive uploads containing PHP/suspicious file extensions to WordPress admin endpoints.
• Monitor file system integrity in web-accessible directories; alert on any new .php, .phtml, .php5, or .php7 file creations.

2. Patch/Upgrade Steps:

• Monitor Themeum's official channels (plugin update page, WordPress plugin directory) for a patched version.
• The fix is expected in version 6.2.3 or later per the NVD description ("before 6.2.3"). When released, update the plugin immediately from the WordPress Admin dashboard or via wp-cli: wp plugin update kirki --version=6.2.3.
• Verify the update resolves both the archive validation and file cleanup deficiencies.

3. Long-Term Hardening:

• Principle of least privilege: Reduce Editor role permissions to only what is functionally required; implement role-based access control with granular capability mapping.
• File upload hardening: Deploy a file validation layer — whitelist allowed extensions, mime-type checking (not just extension), and content inspection on all uploads.
• Web Application Firewall: Deploy a WAF with virtual patching for WordPress plugin vulnerabilities.
• Regular vulnerability scanning: Include WordPress plugin scanning in routine security assessments (WPScan, wpvulndb integration).
• Server hardening: Run PHP as a non-privileged user, enable open_basedir restrictions, disable dangerous PHP functions (system, exec, shell_exec, passthru), and ensure PHP execution is explicitly denied in all upload directories.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-74992 — Official CVE record with NVD description, CVSS metrics, and references.
2. WordPress Plugin Repository — Kirki: https://wordpress.org/plugins/kirki/ — Official plugin page to monitor for patched versions and release notes.
3. Themeum Official Site: https://themeum.com/ — Vendor site for advisory announcements and security notices.
4. CWE-79 (Cross-Site Scripting): https://cwe.mitre.org/data/definitions/79.html — MITRE weakness definition for the XSS component of this vulnerability.
5. WPScan Vulnerability Database: https://wpscan.com/ — WordPress-specific vulnerability database; check for future advisory entries referencing CVE-2026-74992.

Known Threat Actor Activity: No CISA KEV listing, no known active campaigns, and no public exploit code have been identified as of this analysis. The EPSS score of 0.00290 (21.6th percentile) suggests low current exploitation activity. However, the unpatched status and high-impact CVSS scores make this a candidate for future exploitation if technical details become public.