CVE-2026-18347: themeum kirki – freeform page builder, website builder & customizer Missing Authorization
Vulnerability summary
CVE-2026-18347 is a medium (CVSS 4.3) Missing Authorization vulnerability in themeum kirki – freeform page builder, website builder & customizer. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.6% of scored vulnerabilities. Fixed in 6.2.0.
Timeline
- 16-08-2026PublishedVulnerability first disclosed.
- 17-08-2026Last modifiedVulnerability information updated.
Description
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to read arbitrary user metadata and sensitive user record fields — including email address, assigned roles, registration date, and any user_meta values — belonging to any WordPress user including administrators, by supplying a target user ID with a user-type context to the frontend collection endpoint.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- wordfenceSource4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.53%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
+0.22 pp
From 0.30% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Themeum1 product
Wordpress1 product
- kirki≤ 6.1.1 (fixed in 6.2.0)
2 vendors · 2 products