Kirki up to 6.3.2 – Unauthenticated Sensitive User Data Exposure (CVE-2026-107762)
Kirki through 6.3.2 can expose user profile data through an unauthenticated frontend REST authorization bypass. Update to 6.4.0 or later.
Kirki versions through 6.3.2 contain a high-severity unauthenticated information-disclosure vulnerability in the plugin’s frontend REST API. CVE-2026-107762 has a CVSS score of 7.5 and can expose user profile data when a published Kirki template includes a user-type dynamic content block. Kirki 6.4.0 contains the fix.
Vulnerability summary
- Product: Kirki – Freeform Page Builder, Website Builder & Customizer
- Plugin slug:
kirki - Affected versions: 6.3.2 and earlier
- Fixed version: 6.4.0
- CVE: CVE-2026-107762
- Severity: High, CVSS 7.5
- Authentication required: No
- Vulnerability class: IDOR / authorization bypass through a user-controlled key
- Potential exposure: User email addresses, display names, nicenames, registration dates, profile-image URLs, and string-valued user metadata
Exploit path and prerequisites
Wordfence reports that the vulnerable frontend REST flow accepts an attacker-controlled context value. Although Kirki performs permission checks on the context used for the request, affected code later merged the raw request context into the options used to resolve dynamic user content. That mismatch allowed an unauthenticated request to substitute another user identifier after the authorization decision.
The exposure is conditional: a site must have a published page using a Kirki template with at least one user-type dynamic content block. On such a site, target user IDs can often be enumerated through standard WordPress REST behavior, and the vulnerable Kirki response can disclose profile fields and string-valued custom user metadata.
The 6.4.0 source change removes the raw request context from the merge and uses only values that were resolved after permission checks. Wordfence and Patchstack both identify 6.4.0 as the patched release. WordPress.org reports more than 500,000 active installations, which makes prompt updating important even though not every installation meets the template prerequisite.
Immediate remediation
- Update Kirki to version 6.4.0 or later.
- If an immediate update is not possible, deactivate Kirki or unpublish affected Kirki pages that use user-type dynamic content until the plugin is patched.
- Purge WordPress, object, page, and CDN caches after updating.
- Review access logs for anonymous requests to Kirki frontend REST endpoints, especially requests containing repeated or unexpected
contextvalues and changing user IDs. - If sensitive custom user metadata may have been exposed, assess the data involved and follow the site’s incident-response and notification obligations.
Verification and investigation
wp plugin get kirki --fields=name,status,version,update,update_version
wp user list --fields=ID,user_login,user_email,user_registered
wp core verify-checksums
wp plugin verify-checksums kirki
wp post list --post_status=publish --fields=ID,post_title,post_type,post_dateConfirm that the installed version is at least 6.4.0. Inventory published pages built with Kirki and determine whether any use user-type dynamic content. Checksum verification can identify modified plugin files, but it does not determine whether profile data was previously disclosed.
Indicators to review
- Anonymous POST requests to paths under
/wp-json/kirki/v1/frontend/ - Repeated requests to Kirki collection or user endpoints with varying user IDs
- Requests containing unusual, duplicated, or inconsistent
contextandkirki_datavalues - Traffic spikes against pages that render user-type dynamic content
- Unexpected harvesting activity followed by phishing, credential attacks, or abuse involving exposed profile fields
Sources
