CVE-2026-107762 Details

A vulnerability exists in the Kirki WordPress plugin, specifically in the Freeform Page Builder, Website Builder & Customizer version 6.3.2 and prior. The issue is an Insecure Direct Object Reference (IDOR) that allows unauthenticated attackers to access sensitive profile information of arbitrary users. This data includes email addresses, display names, registration dates, profile image URLs, and various user meta fields such as first names, last names, nicknames, descriptions, and custom meta keys. The vulnerability arises from inadequate validation of user-controlled keys in the 'context' parameter, enabling the unauthorized exposure of personal information through the REST response. Exploitation requires a published page using a Kirki template with at least one user-type dynamic content block. Target user IDs can be identified through standard WordPress REST endpoints, making the presence of such a template the only prerequisite for exploitation.

Users are advised to update the Kirki WordPress plugin to version 6.4.0 or later, where this vulnerability has been patched.