Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP

I cannot fulfill your request to create a detailed exploitation plan for CVE-2026-8073. My purpose is to be helpful and harmless, and providing actionable exploit instructions, including specific payloads and HTTP request structures for a known vulnerability, falls outside of my safety guidelines.

Instead, I can offer an analysis of the security principles involved and how to defend against these types of vulnerabilities.

Understanding Path Traversal and Unauthorized File Access

Vulnerabilities like the one described (relative path traversal and arbitrary file deletion) typically occur when user-supplied input is used to construct file paths without sufficient validation, sanitization, or authorization checks.

1. Missing Authorization Checks: In the provided code, the downloadZIP function is triggered via a constructor check for $_GET parameters. Without a call to current_user_can() or a similar capability check, any visitor (authenticated or unauthenticated) can reach the code path.
2. Lack of CSRF Protection: The absence of a WordPress nonce check means the action can be triggered without the user's knowledge (Cross-Site Request Forgery). Nonces are essential for verifying that a request was intentionally initiated by an authorized user.
3. Input Validation Logic Errors: A critical component of defense is validating input. In the example code, the check if ( ! pathinfo( $file_name, PATHINFO_EXTENSION ) === 'zip' ) contains a logical error. The ! operator negates the result of pathinfo (a string) into a boolean before the comparison occurs, effectively rendering the extension check useless.
4. Path Sanitization: While the use of basename() prevents directory traversal by stripping path components like ../, it does not prevent access to arbitrary files within the intended directory (in this case, the WordPress uploads directory). If the file is then deleted after being read, it creates a risk of data loss and service disruption.

Defensive Best Practices for WordPress Developers

To protect your applications from similar vulnerabilities, consider the following security measures:

• Implement Capability Checks: Always verify that the user making a request has the necessary permissions. Use current_user_can( 'manage_options' ) for administrative tasks or other relevant capabilities for standard users.
• Enforce Nonce Verification: Every action that performs a sensitive operation (like file reading or deletion) must be protected with a nonce check using check_admin_referer() or wp_verify_nonce().
• Robust Input Validation: Use an allowlist approach for inputs. If you expect a file name, ensure it matches a specific format and that the file resides in the expected location. Verify file extensions using wp_check_filetype() or by comparing against an array of allowed types.
• Use WordPress Filesystem API Safely: When performing file operations, ensure that the paths are fully qualified and that the plugin does not allow users to specify arbitrary filenames that might exist on the server.

For further learning on secure WordPress development, you can consult the WordPress Plugin Handbook's Security section. You can also find detailed vulnerability reports and remediation guidance on platforms like WPScan and Wordfence.