---
id: "CVE-2026-107762"
kind: "vulnerability"
aliases: ["CVE-2026-107762"]
title: "Kirki WordPress plugin: unauthenticated attackers read other users' profile data"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["kirki", "package", "self-hosted", "user-data", "wordpress"]
not_affected_if: ["no-kirki-templates", "no-user-dynamic-blocks", "plugin-updated"]
published_at: "2026-10-17T03:16:28+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:24:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107762", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Kirki WordPress plugin: unauthenticated attackers read other users' profile data

The Kirki page builder plugin for WordPress, up to and including 6.3.2, fails to validate a user-controlled key in its 'context' parameter, an insecure direct object reference. An unauthenticated attacker can read email addresses, display names and user meta fields of arbitrary users through the REST response, once a published page uses a Kirki template with a user-type dynamic block.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kirki plugin version in the WordPress admin Plugins screen or with `wp plugin get kirki --field=version`; versions up to and including `6.3.2` are affected.
- Look for a published page that uses a Kirki template containing a user-type dynamic content block.

## Fix

- Update the Kirki plugin to a version newer than `6.3.2`; the sources do not name the exact fixed release, so check the plugin's changelog.
- If no fixed version is available, remove the user-type dynamic blocks from published Kirki templates or deactivate the plugin.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107762

## From the sources

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary users' sensitive profile data — including email address, display name, nicename, registration date, profile image URL, and any string-valued user meta fields such as first name, last name, nickname, description, and custom meta keys — via the REST response. Exploitation requires a published page that uses a Kirki template containing at least one user-type dynamic content block; target user IDs are enumerable via standard WordPress REST endpoints, making the only prerequisite the presence of such a template on the site.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_