What the vulnerability does
01Description
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to read arbitrary user metadata and sensitive user record fields — including email address, assigned roles, registration date, and any user_meta values — belonging to any WordPress user including administrators, by supplying a target user ID with a user-type context to the frontend collection endpoint.
Explanation of Vulnerability in Simple Terms
02Summary
Kirki Page Builder versions up to 6.1.1 fail to properly check user permissions before allowing access to certain administrative functions. A logged-in user with low privileges can read sensitive information they should not have access to. Update to a version newer than 6.1.1 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Read sensitive site data they lack permission to access.
Potential impact on your site
04Site Impact
Unauthorized users can view restricted information, potentially exposing site configuration or other users' data.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site.
Key dates
06Disclosure timeline
August 16, 2026
CVE published
