CVE-2026-107762: Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary users' sensitive profile data — including email address, display name, nicename, registration date, profile image URL, and any string-valued user meta fields such as first name, last name, nickname, description, and custom meta keys — via the REST response. Exploitation requires a published page that uses a Kirki template containing at least one user-type dynamic content block; target user IDs are enumerable via standard WordPress REST endpoints, making the only prerequisite the presence of such a template on the site.
Affected Software
Event History
Frequently Asked Questions
Which sites are actually exposed to unauthenticated data disclosure?
A site is exposed if it has a published page using a Kirki template with at least one user-type dynamic content block. The vulnerable behavior affects Kirki versions through 6.3.2.
What does an attacker need to exploit this issue?
No authentication or user interaction is required. The attacker needs only to identify a published page meeting the template condition; target user IDs can be enumerated through standard WordPress REST endpoints.
What information could be disclosed?
The REST response can expose profile data including email address, display name, nicename, registration date, and profile image URL. It may also expose string-valued user meta fields, including first name, last name, nickname, description, and custom meta keys.
How can I determine whether my site is affected?
Review published pages for Kirki templates containing user-type dynamic content blocks. Sites without a published page using such a template do not meet the stated exploitation prerequisite.