CVE-2026-107762

Executive Summary

CVE-2026-107762 is an unauthenticated Insecure Direct Object Reference (IDOR) in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin, affecting all versions up to and including 6.3.2. The flaw resides in handling of the context parameter, which lacks validation on a user-controlled key, allowing attackers to retrieve arbitrary users' profile data (email, display name, registration data, and string-valued user meta) via a REST response. With a CVSS score of 7.5 (High, confidentiality-only), the vulnerability carries significant privacy and account-takeover-enabling risk for any WordPress site running an affected version with a published page that uses a Kirki template containing a user-type dynamic content block.

Technical Analysis

The vulnerability is a classic CWE-639 authorization bypass through a user-controlled key, exposed through WordPress's REST API surface. Kirki's dynamic content feature allows page builders to render live user data into templates. When a template includes a user-type dynamic content block, the plugin resolves which user object to render based on a client-supplied context parameter. Because the plugin does not validate that the requester is authorized to access the referenced user object — and does not constrain the key to the requesting user — the context value can be manipulated to point at any user ID in the WordPress database.

The NVD description states explicitly that "target user IDs are enumerable via standard WordPress REST endpoints." This is a well-known WordPress characteristic: the /wp-json/wp/v2/users endpoint (core REST API) typically exposes author IDs. Because user IDs are sequential and largely public by design in WordPress, the only practical prerequisite for exploitation is the presence of a single published page that uses a Kirki template containing at least one user-type dynamic content block.

The data exposed per NVD is: email address, display name, nicename, registration date, profile image URL, and any string-valued user meta fields (first name, last name, nickname, description, custom meta keys). Note the CVSS vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — network-reachable, no privileges required, no user interaction, high confidentiality impact, no integrity or availability impact. The attack is fully unauthenticated.

The mechanism is consistent with the following class-level chain:

1. Attacker requests a page or REST resource whose Kirki rendering causes the plugin to resolve a user object from the context parameter.
2. Attacker substitutes a target user ID for context.
3. Plugin returns the resolved user's profile fields in the REST response with no authorization check.

No public proof-of-concept code, Nuclei template, or exploit is currently known. The technical chain above is the standard IDOR attack class for this vulnerability; specific function names, file paths, and REST route strings are not disclosed in the NVD description and are therefore not asserted here.

Exploitation Scenarios

Because the vulnerability is unauthenticated and requires only a published Kirki template with a user-type dynamic block, the attack chain is short.

1. Reconnaissance / target identification. The attacker scans the public web (Internet-wide) for WordPress installations serving the Kirki plugin asset path (/wp-content/plugins/kirki/...) and for pages whose rendered HTML contains dynamic-content placeholders associated with user objects. Fingerprinting is trivially done via Shodan or any HTTP crawler using http.html:"/wp-content/plugins/kirki" or http.html:"kirki". The attacker then confirms a target page uses a Kirki template that renders a user-type dynamic content block.

2. Triggering the flaw class. The attacker enumerates valid user IDs through standard WordPress REST endpoints (e.g., /wp-json/wp/v2/users), which typically discloses author IDs. Each discovered user ID becomes a candidate value for the context parameter.

3. Payload / execution. The attacker issues a request to the Kirki-driven resource with context set to the target user ID. Because the plugin fails to validate that the requester is authorized for that user object, the REST response returns the target's profile fields — email, display name, nicename, registration date, avatar URL, and string meta values such as first name, last name, nickname, description, and custom meta keys. No credentials, tokens, or user interaction are required.

4. Post-exploitation impact. Harvested data directly enables:

• Account takeover via password reset — disclosure of registered email addresses combined with display name / nicename allows targeted phishing and credential stuffing against high-value accounts (administrators, editors).
• Reconnaissance and social engineering — first name, last name, nickname, and free-text description fields commonly include organizational role and contact cues.
• Privacy / regulatory exposure — bulk exfiltration of email addresses constitutes a personal-data breach under GDPR/CCPA and similar regimes.
• Custom meta leakage — string-valued custom meta keys may contain application-specific identifiers, API tokens, or onboarding state, depending on site configuration.

The attacker can automate this over the full enumerated user ID range in a single pass; the confidentiality impact is rated High precisely because it applies to all users on the site, including privileged administrators.

Impact Assessment

CVSS 3.1: 7.5 High — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

• Confidentiality: High — arbitrary user profile data (including email) is disclosed without authentication.
• Integrity: None — the attacker does not modify data through this vector.
• Availability: None — no direct denial of service.
• Scope: Unchanged — the impact remains within the vulnerable WordPress installation.

Blast radius. Every WordPress site running Kirki ≤ 6.3.2 where a published page uses a Kirki template containing at least one user-type dynamic content block. Because templates often ship with themes and demo imports, the proportion of exposed sites may be non-trivial; however, no enumeration data is provided, and no shodan-based exposure estimate is asserted.

Business impact.

• Privacy / compliance. Bulk email harvesting is reportable in many jurisdictions.
• Credential / account security. Email disclosure materially lowers the cost of account takeover against administrators.
• Reputational. Unauthenticated data exposure on public websites is visible to third parties and often becomes public through researcher disclosure.

Threat actor relevance. No exploit-in-the-wild, no public PoC, and no CISA KEV listing is known as of this writing. The vulnerability class (unauthenticated IDOR on a WordPress plugin REST surface) is, however, among the most commonly automated targets by criminal scanning infrastructure. Absent public PoC, opportunistic exploitation is possible but not confirmed.

Detection Guidance

Sigma Rule

title: Kirki WordPress Plugin - Unauthenticated IDOR via 'context' Parameter
id: 7c3a1f2e-9b41-4d8e-a35b-6f1c2e9d0b17
status: experimental
description: Detects requests to WordPress/Kirki endpoints that supply a 'context' parameter referencing user objects, characteristic of CVE-2026-107762 IDOR abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107762
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: apache
  service: access
detection:
  selection_path:
    cs-uri-query|contains:
      - 'context='
      - 'context%3D'
  selection_wp:
    cs-uri-stem|contains:
      - '/wp-json/'
      - '/wp-admin/'
      - '/?rest_route='
  selection_user_context:
    cs-uri-query|re: '(?i)context(=|%3D)(user|author)[\w\-]*'
  condition: selection_path and selection_wp and selection_user_context
falsepositives:
  - Legitimate theme/plugin operations using context=user
level: medium
tags:
  - attack.t1190
  - cwe.639

YARA Rule

rule WordPress_Kirki_IDOR_CVE_2026_107762
{
    meta:
        description = "Detects Kirki plugin PHP files containing dynamic-content user-context handling consistent with CVE-2026-107762 (IDOR)"
        author      = "valtersit.com"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-107762"
        cwe         = "CWE-639"
        date        = "2026-01-01"

    strings:
        $plugin_hdr  = "Plugin Name: Kirki" ascii wide nocase
        $ctx_param   = "context" ascii
        $userblock   = /dynamic[\-_]?content|dynamic[\-_]?block/ ascii nocase
        $user_type   = /["']user["']/ ascii
        $rest        = "rest" ascii nocase
        $wp_user     = "wp_users" ascii
        $get_param   = "get_param" ascii
        $request     = /\\\$_GET|\\\$_REQUEST|get_query_var/ ascii

    condition:
        $plugin_hdr and $ctx_param and $userblock and $user_type and ($request or $get_param)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107762 - Kirki WordPress Plugin IDOR Attempt via context Parameter"; flow:established,to_server; method:GET; http.uri; content:"context="; nocase; pcre:"/context=(user|author)[a-z0-9_\-]*/i"; http.uri; content:"/wp-json/"; distance:0; nocase; reference:cve,2026-107762; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-107762; classtype:web-application-attack; sid:2026107762; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method == "GET" and
     wildcard(http.request.uri.path, "/wp-json/*") and
     wildcard(http.request.uri.query, "*(context=*)")]
  [network where http.request.method == "GET" and
     wildcard(http.request.uri.query, "*(context=user*)") or
     wildcard(http.request.uri.query, "*(context=author*)")]

Splunk SPL Query

index=web sourcetype=access_combined
  uri_path=*wp-json* OR uri_path=*rest_route*
| eval q = coalesce(uri_query, url, "")
| where match(q, "(?i)context(=|%3D)(user|author)")
| stats count min(_time) as first_seen max(_time) as last_seen
        dc(uri_query) as distinct_queries by src_ip host
| where count > 3 OR distinct_queries > 3
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,kirki,">
  <rule id="2026107762" level="8">
    <decoded_as>apache-accesslog</decoded_as>
    <regex>context(=|%3D)(user|author)[a-zA-Z0-9_\-]*</regex>
    <regex>/(wp-json/|rest_route=)</regex>
    <description>CVE-2026-107762: Kirki WordPress plugin IDOR attempt via 'context' parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_107762,attack</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). Per NVD, a patched version beyond 6.3.2 is asserted, but this is not independently confirmed by vendor advisory. No workarounds are documented by the vendor.

1. Immediate mitigations (deploy before patch validation):

• Disable or remove any published pages/templates using Kirki user-type dynamic content blocks until the plugin is upgraded. If user-type dynamic rendering is not required operationally, remove the block from all templates.
• If the site cannot be patched immediately, disable the Kirki plugin entirely and substitute static content; do not rely on CSS/JS hiding — the exposure occurs at the server, and the response is returned regardless of front-end presentation.
• Front the site with a WAF and block requests where context matches (user|author) on /wp-json/ and /?rest_route= unless sourced from a known trusted integration.
• Harden the standard WordPress REST user enumeration surface (/wp-json/wp/v2/users) to reduce the reconnaissance primitive — this does not fix the IDOR but removes the enumeration shortcut.
• Monitor web access logs for evidence of bulk context=user... / context=author... queries, per the detection rules above.

2. Patch / upgrade steps:

• Upgrade the Kirki – Freeform Page Builder, Website Builder & Customizer plugin to a version greater than 6.3.2. Because patch status is CLAIMED from NVD and not independently confirmed, verify the fix after upgrade: attempt a context manipulation against a template with a user-type dynamic content block and confirm the REST response no longer returns data for users other than the authenticated requester (or returns an authorization error).
• If no confirmed-fixed version is verifiable, treat the site as exposed and apply the immediate mitigations in section 1.
• Rotate any secrets that may have been exposed via string-valued user custom meta fields (e.g., API tokens, integration keys).

3. Long-term hardening:

• Enforce plugin lifecycle governance: track WordPress plugin versions and apply security updates within defined SLAs; require vendor advisories, not just aggregator claims, before closing a vulnerability ticket.
• Adopt code-review gates for plugins that use user-controlled keys in REST/dynamic-content handlers; require explicit current_user_can() / ownership checks on any handler that resolves user objects from client input.
• Implement least-privilege REST hardening on the WordPress site (disable/limit user listing endpoints, restrict REST API to authenticated contexts where feasible).
• Continuous monitoring: alert on anomalies in context= query patterns and on bulk sequential access to user IDs across /wp-json/ endpoints.
• Add CVE-2026-107762 to the vulnerability management backlog with a "privacy/UNCONFIRMED-PATCH" tag and re-verify NVD and the vendor's changelog for a confirmed fixed version.

References

• NVD — CVE-2026-107762: https://nvd.nist.gov/vuln/detail/CVE-2026-107762
• MITRE CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• WordPress Developer Reference — REST API: https://developer.wordpress.org/rest-api/
• CISA KEV Catalog (CVE-2026-107762 NOT listed as of this writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or in-the-wild campaign is currently known for CVE-2026-107762. EPSS has not been scored by FIRST.org for this CVE.