{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/kirki--6.3.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kirki:kirki:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-107762"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kirki (\u003c= 6.3.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eCVE-2026-107762 affects the Kirki plugin for WordPress in all versions up to and including 6.3.2. The vulnerability exists due to improper validation of the 'context' parameter within the plugin's REST API implementation. An unauthenticated attacker can exploit this Insecure Direct Object Reference (IDOR) to access and exfiltrate sensitive profile information for arbitrary WordPress users.\u003c/p\u003e\n\u003cp\u003eExposed data includes user email addresses, display names, nicenames, registration dates, profile image URLs, and various string-valued meta fields such as first names, last names, nicknames, and descriptions. Successful exploitation requires the presence of a published WordPress page that utilizes a Kirki template containing at least one user-type dynamic content block. Since WordPress user IDs are generally enumerable via standard REST endpoints, the barrier to exploitation is low for sites where these specific templates are active.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance on the target WordPress site to verify the presence of the Kirki plugin and published pages.\u003c/li\u003e\n\u003cli\u003eAttacker uses standard WordPress REST API endpoints (e.g., /wp-json/wp/v2/users) to enumerate valid user IDs on the target system.\u003c/li\u003e\n\u003cli\u003eAttacker identifies a published page or template on the site that utilizes a Kirki user-type dynamic content block.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious REST API request targeting the vulnerable Kirki endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker injects a manipulated 'context' parameter to bypass authorization checks associated with the specific user ID.\u003c/li\u003e\n\u003cli\u003eThe server processes the request and returns a JSON response containing the sensitive user profile data.\u003c/li\u003e\n\u003cli\u003eAttacker parses the response to exfiltrate email addresses, meta fields, and other user account details.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the unauthorized disclosure of sensitive user account information. This data can facilitate further targeted attacks, such as account takeover via credential stuffing, spear-phishing campaigns against administrators, or broader reconnaissance for additional system compromise. The scope of impact is limited to the user information stored within the WordPress database, but the ability to perform this unauthenticated and programmatically increases the risk of large-scale data harvesting.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Kirki plugin to the latest version, ensuring all installations are at least version 6.3.3 or higher.\u003c/li\u003e\n\u003cli\u003eAudit logs for repeated REST API requests targeting user profiles if anomalous patterns are observed.\u003c/li\u003e\n\u003cli\u003eReview all WordPress pages and templates for the use of dynamic user-type content blocks if patching cannot be performed immediately.\u003c/li\u003e\n\u003cli\u003eDisable the REST API for public-facing components if the site's functionality does not require it, to mitigate enumeration and exploitation of IDOR vulnerabilities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-17T04:48:05Z","date_published":"2026-10-17T04:48:05Z","id":"https://feed.craftedsignal.io/briefs/2026-10-kirki-idor/","summary":"The Kirki plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) flaw via the 'context' parameter, allowing unauthenticated attackers to exfiltrate sensitive user profile data.","title":"CVE-2026-107762: IDOR Vulnerability in Kirki WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-kirki-idor/"}],"language":"en","title":"CraftedSignal Threat Feed - Kirki (\u003c= 6.3.2)","version":"https://jsonfeed.org/version/1.1"}