CVE-2026-18347 is an authorization bypass vulnerability (CWE-862) in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin. The plugin fails to properly verify user authorization before allowing access to user metadata via the frontend collection endpoint. Authenticated attackers with custom-level access or above can exploit this to retrieve sensitive user data such as email addresses, roles, registration dates, and user_meta values of any WordPress user, including administrators. This affects all versions up to and including 6.1.1.

An attacker with authenticated access at custom-level or higher can read sensitive user metadata and records of any user, including administrators. This exposure of personal and role information could facilitate further attacks or privilege escalation attempts. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles and permissions to trusted users only and monitor for suspicious activity related to user metadata access. Avoid granting custom-level access to untrusted users.