Description

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to read arbitrary user metadata and sensitive user record fields — including email address, assigned roles, registration date, and any user_meta values — belonging to any WordPress user including administrators, by supplying a target user ID with a user-type context to the frontend collection endpoint.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-16T07:16:30.787Z",
  "pubdate": "2026-08-16T07:16:30.787Z",
  "executiveSummary": "An authorization bypass vulnerability has been identified in the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress in all versions up to, and including, 6.1.1. The flaw stems from insufficient access control enforcement on the frontend collection endpoint, failing to properly verify whether a requesting user possesses the authorization required to execute specific actions. This security deficiency allows authenticated attackers with custom-level access and above to improperly retrieve sensitive data. The potential business and operational impact includes the complete exposure of confidential user records and metadata across the entire WordPress user base, including high-privileged accounts such as administrators. Exploitation requires authenticated access at the custom user level or higher, granting malicious actors the ability to harvest critical intelligence such as email addresses, assigned security roles, and user registration dates, which can facilitate subsequent targeted attacks or privilege escalation vectors within the compromised WordPress environment.",
  "technicalDetails": "The vulnerability resides within the access control logic of the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress. Specifically, the root cause is a failure in authorization validation, where the application does not adequately ensure that the user initiating a request is permitted to perform the requested operation on the frontend collection endpoint. Affected versions include all releases up to, and including, 6.1.1. Exploitation of this vulnerability requires network exposure accessible to authenticated users holding custom-level access or higher. The authentication requirement is relatively low, as attackers only need baseline privileges within the application scope. The attack vector involves an authenticated actor interacting directly with the frontend collection endpoint. By supplying a targeted user ID paired with a user-type context within the request parameters, the attacker bypasses intended authorization boundaries. The vulnerable component fails to restrict data access based on the principle of least privilege, causing the backend logic to process the request and return sensitive records. Post-exploitation impact encompasses the unauthorized disclosure of arbitrary user metadata and sensitive user record fields. This includes confidential data elements such as email addresses, assigned security roles, exact user registration dates, and arbitrary user_meta values associated with any WordPress user. Because this mechanism does not exclude high-privileged accounts, attackers can systematically harvest administrator-level metadata, exposing critical infrastructural intelligence that can be leveraged for further compromise."
}