EUVD-2026-59929
GHSA-mp8r-x8v9-xf3q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain or register low-privilege WordPress account
-
DeliveryAuthenticate and retrieve session credentials
-
ExploitEnumerate target admin user ID (e.g., user ID 1)
-
ExecutionSend crafted request to frontend collection REST endpoint with target user ID
-
PersistReceive exposed email, roles, and user_meta values
-
ImpactUse harvested data for phishing or further reconnaissance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid WordPress account on the target site with custom-level access or above - this threshold includes any subscriber, contributor, author, editor, or custom role, meaning virtually any authenticated WordPress user qualifies. The attacker must send a request to the plugin's frontend collection REST endpoint with a user ID parameter referencing the target user (e.g., an administrator's user ID) and a user-type context value. The WordPress REST API must be reachable from the attacker's location and not blocked by a WAF or network-layer control. Exploitation is limited by the requirement for an existing authenticated session - anonymous/unauthenticated visitors cannot exploit this flaw. The impact is strictly read-only: no data modification or privilege escalation is directly possible through this endpoint alone. |
| Impact | The NVD CVSS 3.1 score of 4.3 (Medium) accurately captures the bounded impact: the attack vector is network (AV:N), complexity is low (AC:L), privilege requirement is low (PR:L), no user interaction is needed (UI:N), scope is unchanged (S:U), and only confidentiality is affected at a low level (C:L/I:N/A:N). No EPSS data was provided in the source intelligence. There is no CISA KEV listing and no confirmed POC code, so exploitation probability at scale is currently unconfirmed. Real-world risk is meaningful but bounded: an attacker must hold an existing WordPress account, and the exposed data - while sensitive - does not directly grant administrative access. However, exposed email addresses, role assignments, and user_meta values can enable highly targeted phishing, account enumeration, or reconnaissance for further privilege escalation. Sites with open user registration face higher practical risk because the authentication barrier can be bypassed by self-registering. The CVSS signal and the real-world risk are consistent here - this is a genuine medium-severity information disclosure concern, not a high-CVSS-but-low-risk issue. |
| Exploit ScenarioDerived | An attacker who has registered or obtained any low-privilege WordPress account (including a custom-role account) on a target site running Kirki 6.1.1 or earlier sends a crafted authenticated REST API request to the plugin's frontend collection endpoint, supplying the user ID of the site administrator (typically user ID 1) and an appropriate user-type context parameter. The endpoint returns the administrator's email address, role assignments, registration date, and all stored user_meta values without performing any authorization check. No public exploit code is confirmed at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 16, 2026
Authorization bypass in the Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress (all versions through 6.1.1) exposes arbitrary user metadata - including email addresses, assigned roles, registration dates, and all user_meta values - to any authenticated user with custom-level access or above. The flaw is rooted in the plugin's frontend collection REST endpoint failing to verify that the requesting user is authorized to retrieve records for the specified target user ID. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low access barrier (any WordPress account qualifies) makes it a realistic risk on sites with open or attacker-controlled user registration.
RemediationAI
A fix commit has been identified in the WordPress plugin Trac repository at the changeset referenced by Wordfence (https://plugins.trac.wordpress.org/changeset?reponame=&old=3629933%40kirki&new=3629933%40kirki), which represents the upstream code correction. However, the exact released patched version beyond 6.1.1 is not explicitly confirmed in available data - site administrators should update to the latest available version of Kirki from the WordPress plugin repository and verify the installed version exceeds 6.1.1. As a compensating control if an immediate update is not possible, administrators can restrict access to the WordPress REST API for unauthenticated and low-privilege authenticated users using a security plugin or web application firewall rule targeting the plugin's frontend collection endpoint; note this may break legitimate front-end customizer functionality that relies on the same endpoint. The Wordfence advisory is available at https://www.wordfence.com/threat-intel/vulnerabilities/id/fa1e0bcd-f881-4b01-b802-7cb18a22a07f.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Kirki plugin (CPE: cpe:2.3:a:themeum:kirki_-_freeform_page_builder,_website_builder_&_customizer:*:*:*:*:*:*:*:*) is a Themeum-developed WordPress framework for building front-end customizers and page layouts. The vulnerability is classified as CWE-862 (Missing Authorization), meaning the code path executes a privileged operation - fetching another user's record from the database - without first checking whether the requesting principal holds permission to access that specific resource. The flaw spans multiple source files: CollectionController.php (the REST endpoint handler), FrontendRESTController.php (the base controller where the authorization gate should be enforced), and Ajax/Users.php and HelperFunctions.php, which perform the actual data retrieval. A user-supplied target user ID and user-type context are passed directly to the collection logic with no ownership or capability check, allowing cross-user data access against any WordPress user object including site administrators.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible REST endpoint requires a valid WordPress account (PR:L); only limited user metadata is disclosed (C:L) with no write or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to read arbitrary user metadata and sensitive user record fields - including email address, assigned roles, registration date, and any user_meta values - belonging to any WordPress user including administrators, by supplying a target user ID with a user-type context to the frontend collection endpoint.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB