WordPress security changelog
HIGH CVE-2026-107762 Deferred

Kirki – Freeform Page Builder, Website Builder & Customizer: Broken access control

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary users' sensitive profile data — including email address, display name, nicename, registration date, profile image URL, and any string-valued user meta fields such as first name, last name, nickname, description, and custom meta keys — via the REST response. Exploitation requires a published page that uses a Kirki template containing at least one user-type dynamic content block; target user IDs are enumerable via standard WordPress REST endpoints, making the only prerequisite the presence of such a template on the site. The export supplies no additional endpoint, action, parameter or function details beyond those described above.

CVE / CNA score 7.5 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Kirki – Freeform Page Builder, Website Builder & Customizer
Plugin slug
kirki
Affected
<= 6.3.2
Safe version
See mitigation notes
Published
Oct 17, 2026
Weakness
CWE-639 — Authorization Bypass Through User-Controlled Key

This CVE was published Oct 17, 2026 and is one of 42 known issues for this plugin.

What to do

Update, patch or deactivate.

Official author notes reviewed on 2026-10-17 through 6.4.0 did not establish a fixed version for this CVE. No matching dynamic-user-context disclosure fix; earlier sensitive-metadata note is within the affected range. This archive's uncertainty does not establish that the current release remains vulnerable. Consult the author for current remediation guidance; restrict or disable affected functionality when warranted. Official notes: https://wordpress.org/plugins/kirki/#developers. Authorize the requested user context and return only explicitly public profile fields from dynamic-content responses.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary users' sensitive profile data — including email address, display name, nicename, registration date, profile image URL, and any string-valued user meta fields such as first name, last name, nickname, description, and custom meta keys — via the REST response. Exploitation requires a published page that uses a Kirki template containing at least one user-type dynamic content block; target user IDs are enumerable via standard WordPress REST endpoints, making the only prerequisite the presence of such a template on the site.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Primary and upstream sources