Is CVE-2026-107762 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107762 being exploited in the wild.

How severe is CVE-2026-107762?

High severity, with a CVSS score of 7.5, published 17 October 2026.

Which products and versions are affected?

Kirki up to and including 6.3.2.

Is there a fix for CVE-2026-107762?

Yes: fixed in Kirki 6.3.3 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107762 attacked?

It is attacked over the network.

Am I affected by CVE-2026-107762?

Check whether you run Kirki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107762: Kirki plugin insecure direct object reference in user profile data

CVE-2026-107762 · Severity: high · CVSS 7.5 · Published 2026-10-17

The Kirki page builder plugin for WordPress contains a vulnerability that allows unauthenticated attackers to retrieve sensitive user profile information including email addresses, display names, and custom user fields. An attacker can exploit this by accessing pages that use Kirki's user-type dynamic content blocks, exposing data for any enumerable WordPress user on the site without requiring authentication or special privileges.

Vendors: Kirki.

Quick answers

Is CVE-2026-107762 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107762 being exploited in the wild.
How severe is CVE-2026-107762?: High severity, with a CVSS score of 7.5, published 17 October 2026.
Which products and versions are affected?: Kirki up to and including 6.3.2.
Is there a fix for CVE-2026-107762?: Yes: fixed in Kirki 6.3.3 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107762 attacked?: It is attacked over the network.
Am I affected by CVE-2026-107762?: Check whether you run Kirki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Kirki 6.3.3 and later

Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) in the REST API endpoints, specifically in the 'context' parameter of user-type dynamic content blocks. The plugin fails to validate user input on this parameter, allowing an attacker to directly reference and retrieve arbitrary user objects. Exploitation requires a published page using a Kirki template with at least one user-type dynamic content block, and user IDs are enumerable via standard WordPress REST endpoints.

Affected products

Kirki Kirki up to and including 6.3.2

Timeline

2026-10-17: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.