CVE-2026-107762: CWE-639 Authorization Bypass Through User-Controlled Key in themeum Kirki – Freeform Page Builder, Website Builder & Customizer

CVE-2026-107762 is an insecure direct object reference vulnerability (CWE-639) in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin. The vulnerability arises from missing validation on a user-controlled 'context' parameter in the REST API, allowing unauthorized access to sensitive user profile information. Exploitation requires a published page with a Kirki template containing at least one user-type dynamic content block. User IDs can be enumerated via standard WordPress REST endpoints, facilitating targeted data exposure. This affects all versions up to and including 6.3.2.

An unauthenticated attacker can retrieve sensitive user profile data such as email addresses, display names, nicenames, registration dates, profile image URLs, and any string-valued user meta fields including first name, last name, nickname, description, and custom meta keys. This exposure compromises user privacy and could facilitate further attacks such as phishing or social engineering. There is no impact on integrity or availability reported.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, avoid publishing pages that use Kirki templates with user-type dynamic content blocks to reduce exposure. Restricting access to the REST API or implementing additional access controls may help mitigate risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.