CVE-2026-18347

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to read arbitrary user metadata and sensitive user record fields — including email address, assigned roles, registration date, and any user_meta values — belonging to any WordPress user including administrators, by supplying a target user ID with a user-type context to the frontend collection endpoint.

• CWE-862

• https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.9/includes/API/Frontend/Controllers/CollectionController.php#L97
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.9/includes/API/Frontend/Controllers/FrontendRESTController.php#L42
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.9/includes/API/Frontend/Controllers/FrontendRESTController.php#L82
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.9/includes/Ajax/Users.php#L227
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.9/includes/HelperFunctions.php#L1098
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.1.1/includes/API/Frontend/Controllers/CollectionController.php#L97
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.1.1/includes/API/Frontend/Controllers/FrontendRESTController.php#L42
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.1.1/includes/API/Frontend/Controllers/FrontendRESTController.php#L82
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.1.1/includes/Ajax/Users.php#L227
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.1.1/includes/HelperFunctions.php#L1098
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3629933%40kirki&new=3629933%40kirki
• https://www.wordfence.com/threat-intel/vulnerabilities/id/fa1e0bcd-f881-4b01-b802-7cb18a22a07f?source=cve

Published

Aug 16, 2026

Last Modified

Aug 20, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18335The Kirki – Freeform Page Builder, Website Builder & Customi…5.4
• CVE-2026-1834The Ibtana – WordPress Website Builder plugin for WordPress …6.4
• CVE-2026-18341IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authentica…8.8
• CVE-2026-18344The Wp Responsive Thumbnail Slider plugin for WordPress is v…6.1
• CVE-2026-18345The WP User Manager plugin for WordPress is vulnerable to un…4.3
• CVE-2026-18346The TikTok plugin for WordPress is vulnerable to authorizati…5.3
• CVE-2026-18348Missing authorization check in the upload_azure, upload_sftp…4.1
• CVE-2026-18349Improper protection against voltage and clock glitches vulne…7.3
• CVE-2026-1835A vulnerability was identified in lcg0124 BootDo up to e93dd…4.3
• CVE-2026-18351The Drag and Drop File Upload for Elementor Forms plugin for…9.8
• CVE-2026-18352The User Access Manager plugin for WordPress is vulnerable t…7.5
• CVE-2026-18353PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT a…8.8