CVE-2026-107762: themeum kirki – freeform page builder, website builder & customizer

Vulnerability summary

CVE-2026-107762 is a high (CVSS 7.5) vulnerability in themeum kirki – freeform page builder, website builder & customizer. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.2% of scored vulnerabilities.

Timeline

1. 17-10-2026
   PublishedVulnerability first disclosed.
2. 18-10-2026
   Last modifiedVulnerability information updated.

Description

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary users' sensitive profile data — including email address, display name, nicename, registration date, profile image URL, and any string-valued user meta fields such as first name, last name, nickname, description, and custom meta keys — via the REST response. Exploitation requires a published page that uses a Kirki template containing at least one user-type dynamic content block; target user IDs are enumerable via standard WordPress REST endpoints, making the only prerequisite the presence of such a template on the site.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.