An unauthenticated arbitrary file deletion vulnerability in the Kirki WordPress plugin (up to v6.0.6) allows attackers to disrupt services or compromise site integrity.

This is a relative path traversal vulnerability (CWE-23) resulting from insufficient file path validation and a missing capability check in the 'downloadZIP' function. It allows unauthenticated users to trigger file deletion operations on the host server.

The ability for an unauthenticated attacker to delete arbitrary files on a web server represents a critical threat to business continuity and data integrity. With a CVSS score of 7.5, this vulnerability could be leveraged to delete configuration files, site content, or security-critical files, leading to complete site downtime or unauthorized system modification.

Immediate Action: Update the Kirki – Freeform Page Builder, Website Builder & Customizer plugin to version 6.0.7 or later immediately.

Proactive Monitoring: Review web server access logs for requests targeting the 'downloadZIP' function or suspicious path traversal patterns (e.g., ../ strings) in URI parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block path traversal attempts and restrict access to plugin-specific API endpoints.

Public Exploit Available: Unknown

This vulnerability should be addressed immediately, as it provides a trivial path for attackers to cause significant service disruption. Ensure the Kirki plugin is updated to the patched version (6.0.7) and perform a security audit of the WordPress installation to ensure no unauthorized files have been modified or deleted.