CVE-2026-18347
Received Received - Intake

Authorization Bypass in Kirki WordPress Plugin

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: Wordfence

Description
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to read arbitrary user metadata and sensitive user record fields — including email address, assigned roles, registration date, and any user_meta values — belonging to any WordPress user including administrators, by supplying a target user ID with a user-type context to the frontend collection endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-18347
EUVD
EUVD-2026-59929

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kirki freeform_page_builder to 6.1.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Kirki plugin for WordPress has an authorization bypass flaw in versions up to 6.1.1. It fails to verify user permissions properly, allowing authenticated attackers with custom-level access or higher to read sensitive user data like email addresses, roles, registration dates, and user_meta values for any WordPress user, including administrators, by manipulating the frontend collection endpoint with a target user ID.

Detection Guidance

Check WordPress sites using the Kirki plugin up to version 6.1.1. Look for unauthorized access to user metadata via the frontend collection endpoint. Review server logs for unusual requests targeting user data endpoints.

Impact Analysis

If exploited, attackers could access private user information such as email addresses, account roles, and registration details for all WordPress users on a site. This could lead to privacy breaches, identity theft, or further targeted attacks against users or administrators.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without consent and HIPAA by compromising protected health information if user data includes such details. Organizations may face legal penalties, fines, or reputational damage for failing to protect sensitive user data.

Mitigation Strategies

Update the Kirki plugin to the latest version beyond 6.1.1 immediately. Remove or disable the plugin if updates are unavailable. Restrict custom-level user access to only necessary personnel. Monitor user metadata access logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18347. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart