CVE-2026-18347

Executive Summary

CVE-2026-18347 is an authorization bypass vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress, affecting all versions up to and including 6.1.1. The plugin fails to verify that an authenticated user is authorized to query other users' information, allowing attackers with at least custom-level access to read arbitrary user metadata and sensitive record fields — including email addresses, assigned roles, registration dates, and any user_meta values — belonging to any WordPress user, including administrators. At the time of writing the plugin is unpatched, no public exploit code is confirmed, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog; however, the exposed data is sensitive and the attack surface is potentially large given the plugin's widespread use.

Technical Analysis

The vulnerability is categorized under CWE-862 (Missing Authorization). The root cause is an absent access-control check in the plugin's frontend collection endpoint: the endpoint does not confirm that the requesting user has the right to retrieve metadata for a specified target account. This is a classic broken access control flaw in which an authenticated, low-privilege principal is able to invoke a data-collection function that was intended to be restricted to authorized users.

Mechanism level: the plugin exposes a frontend collection endpoint on the WordPress site (an HTTP-reachable route, not an administrative or backend-only function). The action performed by the endpoint — collating user metadata — is triggered by supplying a target user ID alongside a user-type context. Because authorization is not enforced, the endpoint treats the request as legitimate and returns the requested record. The attacker must be authenticated (CVSS PR:L), meaning a valid account with the plugin's "custom" access level or higher is required. No user interaction is involved (UI:N), and the attack is carried out over the network against the web service (AV:N, AC:L).

Attack surface considerations:

• WordPress sites running any Kirki plugin version from initial release through 6.1.1 are affected. The plugin's page-builder functionality means it is commonly installed alongside themes that would not normally grant user data access to low-privilege accounts.
• The data returned includes standard user-record fields (email address, assigned roles, registration date) and arbitrary user_meta values. user_meta is a free-form key/value store used by WordPress and third-party plugins to persist per-user settings; depending on site configuration, these meta values can hold profile information, display preferences, feature flags, and other fields that a site operator did not intend to expose to all authenticated users.
• The phrase "custom-level access and above" indicates the plugin defines an access tier named "custom" (likely tied to its customizer functionality). Any account at that tier or higher — potentially contributor/customizer-type roles or roles created by third-party membership plugins — is sufficient to trigger the flaw.
• The endpoint is frontend-facing, which means it is directly reachable by any user who can authenticate to the site, and requests may bypass admin-only restrictions imposed by other plugins if those plugins rely on the assumption that data endpoints are inaccessible to low-privilege users.

The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (score 4.3, Medium). The scope is unchanged; confidentiality impact is Low, with no integrity or availability impact. The Low confidentiality rating reflects the modest sensitivity of individual fields, but from an attacker's perspective the ability to enumerate every account on a site, including administrators, materially raises the practical risk.

No code-level details (function names, exact route patterns, or parameter names beyond "user ID" and "user-type context") are disclosed in the available NVD description. Consequently, the precise vulnerable function and endpoint signature cannot be cited. The exploitation logic described in this report is derived from the vulnerability class (missing authorization leading to data collection), consistent with the description provided.

Exploitation Scenarios

No public PoC or in-the-wild exploitation is confirmed for CVE-2026-18347. The attack chain below is inferred from the vulnerability class and the NVD description, not from a documented exploit.

1. Reconnaissance and target identification

   • The attacker identifies a WordPress site suspected of running the Kirki plugin. This can be performed via plugin version disclosure in page source, predictable asset paths, or WordPress fingerprinting.
   • The attacker registers for or obtains a valid account on the target site that possesses at least the plugin's "custom" access level. On sites with open registration or membership systems that grant contributor/custom-level roles, this requirement is trivially satisfied.

2. Triggering the vulnerable authorization check

   • Using the authenticated session, the attacker sends requests to the plugin's frontend collection endpoint.
   • The request includes a user-type context and a target user ID. The target user ID identifies the victim account (e.g., an administrator account). The endpoint fails to verify that the authenticated user is authorized to read another user's metadata — the missing authorization check of CWE-862.

3. Payload/execution method (vulnerability-class level)

   • The execution mechanism is an HTTP request manipulating the target-user identifier and the user-type context parameters. Because the site's access-control layer is not consulted, the endpoint collates and returns the target user's record fields.
   • To enumerate multiple users, the attacker repeats the request while varying the target user ID (e.g., sequentially iterating user IDs). Each response leaks the metadata fields described in the CVE: email address, assigned roles, registration date, and arbitrary user_meta entries for that account.

4. Post-exploitation impact

   • Harvested email addresses enable targeted phishing campaigns against site administrators, which can lead to credential theft and subsequent administrative compromise.
   • Role and registration-date data aid attacker profiling: admin accounts, recently created accounts, and service accounts can be prioritized as targets.
   • Arbitrary user_meta disclosure may expose integration tokens, profile data, or configuration values stored per-user by other plugins, widening the information exposure beyond what the CVSS vector alone suggests.

Operator guidance: although no public exploit is available, the low complexity and the presence of a trivial data-exfiltration primitive make independent weaponization highly probable once the exact endpoint signature is reverse-engineered from the plugin source.

Impact Assessment

Business impact:

• Confidentiality breach of user PII: email addresses and registration dates are personal data in most jurisdictions; exposure may constitute a reportable data breach under GDPR/CCPA-style obligations.
• Account intelligence for targeted attacks: role assignments and metadata values inform social engineering and credential-stuffing campaigns aimed at administrators.
• Trust damage: sites using Kirki to offer membership or customized experiences may face user backlash if account metadata is disclosed.

Affected systems:

• All WordPress deployments running the Kirki – Freeform Page Builder, Website Builder & Customizer plugin, versions ≤ 6.1.1.
• Sites with many low-privilege accounts (open registration, multi-author blogs, e-commerce customers with account areas) are at heightened risk because the pool of potential attackers with "custom-level access and above" is large.
• Multi-tenant WordPress installations (e.g., WordPress Multisite) may allow a low-privilege user on one subsite to read metadata of users on other subsites, if user records are shared.

Blast radius: The CVSS vector indicates Low confidentiality (C:L) with no impact to integrity or availability (I:N/A:N), and unchanged scope (S:U). The practical blast radius is nevertheless influenced by (1) absence of a patch, which means no fix is available for operators to deploy, and (2) the user_meta component, whose sensitivity depends entirely on what plugins and site administrators store in that table. In the worst case, user_meta can contain session tokens, security keys, password-reset hashes, or OAuth integration credentials, effectively converting a low-severity leak into a critical credential-exposure incident.

EPSS has not yet scored this CVE; exploit probability cannot be estimated from FIRST data. The CISA KEV catalog does not list CVE-2026-18347, and no threat-actor campaigns have been publicly attributed to this vulnerability as of this report.

Detection Guidance

Detection rules for CVE-2026-18347 are necessarily based on the vulnerability class and the accessible description of the frontend collection endpoint, because exact route paths and parameter names have not been publicly disclosed. All rules below are candidate detections that should be tuned against verified request patterns once the endpoint signature is confirmed or a patch diff becomes available. The primary detection strategy is behavioral: look for authenticated users issuing repeated, structured requests that enumerate WordPress user IDs with a user-type context, and for responses that contain user-record fields (email, roles, registration date, user_meta).

Sigma Rule

title: CVE-2026-18347 Kirki WordPress Plugin User Metadata Enumeration
id: 5b1f6c2e-9a3d-4c7b-8e21-6f0d1a2b3c4d
status: experimental
description: Detects HTTP requests to the Kirki plugin frontend collection endpoint exhibiting user ID enumeration with a user-type context, consistent with CVE-2026-18347 authorization bypass.
logsource:
  category: webserver
  product: apache
detection:
  selection:
    http.response.status_code: 200
    url.path|contains: kirki
    url.query|contains|all:
      - user
      - id
  correlation:
    field: source.ip
    condition: count >= 5 within 10m
  filter_known_scanner:
    user_agent|contains:
      - Googlebot
      - Bingbot
  condition: selection and correlation and not filter_known_scanner
falsepositives:
  - Legitimate plugins or themes that query user metadata for publicly visible author pages (e.g., author profile blocks)
  - Monitoring and uptime agents making authenticated requests
level: medium
tags:
  - attack.collection
  - attack.t1005
  - cve.2026.18347
  - cwe.862

YARA Rule

rule CVE_2026_18347_Kirki_User_Enumeration_Tooling
{
    meta:
        author      = "valtersit.com Threat Intelligence"
        date        = "2026-01-01"
        description = "Detects scripts, webshells, or offensive tooling that reference CVE-2026-18347 or automate Kirki plugin user metadata collection against WordPress sites."
        reference   = "CVE-2026-18347"
        score       = 60

    strings:
        $cve_ref = "CVE-2026-18347" ascii wide nocase
        $plugin_ref = "wp-content/plugins/kirki" ascii wide nocase
        $param_user = "user_id" ascii wide nocase
        $param_utype = "user-type" ascii wide nocase
        $meta_field = "user_meta" ascii wide nocase
        $role_field = "roles" ascii wide nocase
        $loop = "range(1" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x7F454C46 or any of them
        and
        (
            ($cve_ref and ($plugin_ref or $param_user or $param_utype or $meta_field))
            or
            (all of ($plugin_ref, $param_user, $meta_field))
            or
            (all of ($plugin_ref, $param_utype, $role_field) and #loop > 0)
        )
}

This rule is intended for scanning suspected attacker hosts, dropped scripts, and tool archives. It is not designed to match inbound HTTP traffic. Tune the condition if your environment observes legitimate scripts referencing the plugin path.

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET WEB_SERVER CVE-2026-18347 Kirki WordPress Plugin Authorization Bypass User Enumeration Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"kirki"; nocase; http.uri; content:"user"; nocase; distance:0; pcre:"/(user[-_]?id|user[-_]?type)/i"; classtype:attempted-recon; sid:202618347; rev:1; metadata:created_at 2026-01-01, cve CVE-2026-18347;)

Notes: The rule matches authenticated HTTP GET requests whose URI references the plugin slug (kirki) and contains a user-identifier or user-type parameter. Because the exact endpoint path is not publicly confirmed, the URI match is intentionally broad. For production use, restrict the rule to paths that correspond to the verified frontend collection endpoint once disclosed, and consider adding a threshold (threshold: type both, track by_src, count 5, seconds 300) to reduce false positives from legitimate author page queries.

Elastic Detection

Elastic EQL — detects a sequence of enumeration requests from a single source against the Kirki plugin:

sequence by source.ip with maxspan=10m, runs=10
  [ network where network.protocol == "http" and http.request.method == "GET"
    and url.path contains "kirki"
    and url.query like "*user*id*"
    and url.query like "*user*type*" ]

This rule fires when 10 or more matching requests are observed from the same source IP within 10 minutes. The 10-request threshold and 10-minute window are starting points; adjust to site traffic baselines. An alternative signature-style query for single suspicious requests:

network where network.protocol == "http" and http.request.method == "GET"
  and url.path contains "kirki"
  and url.query like "*user*id*"
  and http.response.status_code == 200
  and url.query like "*type*"

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri_path, "(?i)kirki")
| where match(uri_query, "(?i)user.*id") OR match(uri_query, "(?i)user.*type")
| bucket _time span=5m
| stats dc(uri_query) AS distinct_uid_queries, count AS request_count BY src_ip, _time, uri_path
| where distinct_uid_queries >= 5 AND request_count >= 10
| sort - request_count

Replace index=web sourcetype=access_combined with your web access log source. The query scores source IPs that issue many distinct user-ID queries against the plugin path within a five-minute bucket, which is characteristic of ID enumeration. Add an additional filter on user or status=200 if false positives occur from static assets.

Wazuh OSSEC Rule

<group name="web,wordpress,">
  <rule id="100401" level="9">
    <decoded>
      <match>kirki</match>
    </decoded>
    <regex>user[-_]?id|user[-_]?type</regex>
    <description>CVE-2026-18347: Possible Kirki plugin user metadata enumeration attempt</description>
    <mitre>
      <id>T1005</id>
    </mitre>
    <group>access_control,information_disclosure,</group>
  </rule>
</group>

This rule matches web server decoders (Apache/Nginx) where the request line references kirki and contains user-ID or user-type parameters. Assign the rule to the appropriate decoder group for your Wazuh deployment (e.g., the built-in web decoder for access logs). Level 9 is appropriate because the activity indicates active information gathering; if numerous distinct user IDs are observed per source IP in a short window, supplement the rule with a Wazuh frequency alert:

<rule id="100402" level="12" frequency="10" timeframe="300">
  <if_matched_sid>100401</if_matched_sid>
  <description>CVE-2026-18347: High volume of Kirki user enumeration requests from a single source</description>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence is available from any tracked source, no vendor advisory has been published, and no patched version has been identified. The plugin's manufacturer has not released a fixed release as of this report.

1. Immediate mitigations

   • If the Kirki plugin's page-builder/customizer functionality is not essential to the site, disable and remove the plugin until a patched version is released. This eliminates the vulnerable attack surface.
   • If removal is not possible, deploy a Web Application Firewall (WAF) rule that blocks requests to the plugin's frontend collection endpoint from non-administrator roles. Because the endpoint name is not yet publicly confirmed, begin by blocking requests that combine a user-type context and a target user ID parameter on paths containing kirki, then verify that legitimate theme customizer traffic is not impacted.
   • Review and audit all accounts with "custom-level access and above". Reduce account counts, rotate credentials for accounts that have had exposure to compromised sessions, and disable unused accounts. Custom roles should be granted the least privileges necessary.
   • Monitor authentication logs for enumeration patterns: a single user issuing repeated requests with sequential user IDs should be treated as compromised-account activity.
   • As a compensating control, consider restricting the plugin's frontend endpoint to specific IP ranges (e.g., via .htaccess or server-level access control) if the site's user base is geographically or organizationally constrained.

2. Patch and upgrade steps

   • No official patch exists at this time. Subscribe to the WordPress plugin changelog for Kirki and to WordPress security mailing lists (e.g., WPScan, Patchstack) to receive notification when a fixed version is released.
   • When a patched version above 6.1.1 becomes available, test it in a staging environment first, then deploy to production. After upgrade, verify the frontend collection endpoint enforces an authorization check for all user roles.
   • If an emergency fix is feasible on your stack, apply a temporary source-level patch that adds a capability check (e.g., current_user_can('edit_users') or equivalent) to the collection callback once the vulnerable function is identified via vendor code review. This is not possible without access to the plugin source and is listed as an emergency action only.

3. Long-term hardening

   • Enforce least privilege for all WordPress roles. Audit every role's capabilities, especially roles that include the plugin's "custom" access level. Revoke custom-level access from any role that does not strictly require it.
   • Register for CVE notification feeds (NVD, CISA) and vulnerability databases that cover WordPress plugins (WPScan, Patchstack) so that future authorization-bypass issues in this plugin are detected earlier.
   • Deploy file integrity monitoring on the wp-content/plugins/ directory to detect tampering or backdoor insertion if attackers combine this disclosure with another foothold.
   • Periodically review user_meta contents stored by other plugins and remove sensitive values (tokens, keys, hashes) that do not need to be persisted in user metadata.
   • Implement WordPress security hardening: restrict registration to trusted domains, enforce strong password policies for low-privilege accounts, and require two-factor authentication for any account that has administrative or customizer-level access.

References

1. NVD Entry for CVE-2026-18347 — https://nvd.nist.gov/vuln/detail/CVE-2026-18347
2. CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
3. MITRE ATT&CK Technique T1005: Data from Local System — https://attack.mitre.org/techniques/T1005/
4. Kirki plugin page on WordPress.org (official distribution channel) — https://wordpress.org/plugins/kirki/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-18347 is not currently listed) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

As of this report, there are no known threat-actor campaigns, no in-the-wild exploit evidence, no public exploit code, and no CISA KEV listing associated with CVE-2026-18347. EPSS has not yet scored this vulnerability. The absence of an identified patch, combined with the low complexity of the flaw class, should treat this CVE as a priority monitoring item for all vulnerable WordPress deployments.