CVE-2026-18347 is an authorization bypass vulnerability (CWE-862) in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin. The vulnerability affects all versions up to and including 6.1.1. It allows authenticated attackers with custom-level access or above to bypass authorization checks and retrieve sensitive user metadata and fields for any WordPress user by supplying a target user ID to the frontend collection endpoint. This flaw arises from improper verification of user permissions within the plugin's access control mechanisms.

An attacker with authenticated custom-level access or higher can read sensitive user information such as email addresses, assigned roles, registration dates, and any user_meta values for any user, including administrators. This exposure of sensitive user data could facilitate further attacks or privilege escalation but does not directly allow modification or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been documented as of the published date. Until a patch is available, restrict custom-level access users and above from untrusted parties and monitor for suspicious activity related to user metadata access.