{"id":"CVE-2026-107762","kind":"vulnerability","aliases":["CVE-2026-107762"],"related":[],"title":"Kirki WordPress plugin: unauthenticated attackers read other users' profile data","description":"The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary users' sensitive profile data — including email address, display name, nicename, registration date, profile image URL, and any string-valued user meta fields such as first name, last name, nickname, description, and custom meta keys — via the REST response. Exploitation requires a published page that uses a Kirki template containing at least one user-type dynamic content block; target user IDs are enumerable via standard WordPress REST endpoints, making the only prerequisite the presence of such a template on the site.","summary":"The Kirki page builder plugin for WordPress, up to and including 6.3.2, fails to validate a user-controlled key in its 'context' parameter, an insecure direct object reference. An unauthenticated attacker can read email addresses, display names and user meta fields of arbitrary users through the REST response, once a published page uses a Kirki template with a user-type dynamic block.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kirki","package","self-hosted","user-data","wordpress"],"not_affected_if":["no-kirki-templates","no-user-dynamic-blocks","plugin-updated"],"how_to_check":"- Check the installed Kirki plugin version in the WordPress admin Plugins screen or with `wp plugin get kirki --field=version`; versions up to and including `6.3.2` are affected.\n- Look for a published page that uses a Kirki template containing a user-type dynamic content block.","fix":"- Update the Kirki plugin to a version newer than `6.3.2`; the sources do not name the exact fixed release, so check the plugin's changelog.\n- If no fixed version is available, remove the user-type dynamic blocks from published Kirki templates or deactivate the plugin.","status":"open","published_at":"2026-10-17T03:16:28+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:24:47+00:00","updated_at":"2026-10-25T03:24:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:24:47Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Kirki plugin to a version newer than `6.3.2`; the sources do not name the exact fixed release, so check the plugin's changelog.\n- If no fixed version is available, remove the user-type dynamic blocks from published Kirki templates or deactivate the plugin.","reach":"internet","title":"Kirki WordPress plugin: unauthenticated attackers read other users' profile data","impact":"medium","summary":"The Kirki page builder plugin for WordPress, up to and including 6.3.2, fails to validate a user-controlled key in its 'context' parameter, an insecure direct object reference. An unauthenticated attacker can read email addresses, display names and user meta fields of arbitrary users through the REST response, once a published page uses a Kirki template with a user-type dynamic block.","category":"package","nicknames":[],"who_cares":["wordpress","kirki","self-hosted","user-data"],"confidence":0.7,"needs_auth":"no","worst_case":"Attackers read emails and profile data of arbitrary WordPress users.","analyst_note":"Find the fixed Kirki version and confirm the affected 'context' parameter behaviour in the NVD entry or plugin changelog.","how_to_check":"- Check the installed Kirki plugin version in the WordPress admin Plugins screen or with `wp plugin get kirki --field=version`; versions up to and including `6.3.2` are affected.\n- Look for a published page that uses a Kirki template containing a user-type dynamic content block.","needs_analyst":true,"not_affected_if":["no-kirki-templates","no-user-dynamic-blocks","plugin-updated"],"who_is_affected":"WordPress sites running Kirki at version 6.3.2 or earlier are exposed when at least one published page uses a Kirki template with a user-type dynamic content block. Attackers can enumerate user IDs through standard WordPress REST endpoints, so the template is the only prerequisite. Sites without Kirki, or without such a template on a published page, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":3489,"output_tokens":724,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107762':13A,16A '-2026':12A,15A '6.3.2':37B,115C 'address':61B,145C 'arbitrari':69B,138C 'attack':5A,57B,135C 'block':89B,197C 'builder':29B,94C,96C 'contain':188C 'content':196C 'context':48B,118C 'control':44B,127C 'custom':97C,171C 'cve':11A,14A 'data':10A,24B,142C 'date':150C 'descript':169C 'direct':52B,105C 'display':62B,146C 'due':120C 'dynam':88B,195C 'email':60B,144C 'endpoint':207C 'enumer':202C 'exploit':178C 'expos':137C 'fail':38B 'field':67B,161C 'first':164C 'freeform':92C 'host':21B 'id':200C 'imag':152C 'includ':36B,114C,143C 'insecur':51B,104C 'key':45B,128C,173C 'kirki':1A,17B,27B,81B,91C,186C 'last':166C 'least':190C 'make':130C,208C 'meta':66B,160C,172C 'miss':122C 'name':63B,147C,165C,167C 'nicenam':148C 'nicknam':168C 'object':53B,106C 'one':191C 'packag':18B 'page':28B,78B,93C,182C 'paramet':49B,119C 'plugin':3A,30B,98C 'possibl':132C 'prerequisit':211C 'presenc':213C 'profil':9A,141C,151C 'publish':77B,181C 'read':6A,59B 'refer':54B,107C 'registr':149C 'requir':179C 'respons':74B,177C 'rest':73B,176C,206C 'self':20B 'self-host':19B 'sensit':140C 'site':220C 'standard':204C 'string':157C 'string-valu':156C 'target':198C 'templat':82B,187C,217C 'type':87B,194C 'unauthent':4A,56B,134C 'url':153C 'use':79B,184C 'user':8A,23B,43B,65B,70B,86B,126C,139C,159C,193C,199C 'user-control':42B 'user-data':22B 'user-typ':85B,192C 'valid':40B,123C 'valu':158C 'version':110C 'via':116C,174C,203C 'vulner':102C 'websit':95C 'wordpress':2A,25B,32B,100C,205C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running Kirki at version 6.3.2 or earlier are exposed when at least one published page uses a Kirki template with a user-type dynamic content block. Attackers can enumerate user IDs through standard WordPress REST endpoints, so the template is the only prerequisite. Sites without Kirki, or without such a template on a published page, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T03:16:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107762","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107762","severity":null,"published_at":"2026-10-17T03:16:28+00:00","modified_at":"2026-10-19T15:16:45+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}