Exposed data includes user email addresses, display names, nicenames, registration dates, profile image URLs, and various string-valued meta fields such as first names, last names, nicknames, and descriptions. Successful exploitation requires the presence of a published WordPress page that utilizes a Kirki template containing at least one user-type dynamic content block. Since WordPress user IDs are generally enumerable via standard REST endpoints, the barrier to exploitation is low for sites where these specific templates are active.

Attack Chain

1. Attacker performs reconnaissance on the target WordPress site to verify the presence of the Kirki plugin and published pages.
2. Attacker uses standard WordPress REST API endpoints (e.g., /wp-json/wp/v2/users) to enumerate valid user IDs on the target system.
3. Attacker identifies a published page or template on the site that utilizes a Kirki user-type dynamic content block.
4. Attacker crafts a malicious REST API request targeting the vulnerable Kirki endpoint.
5. Attacker injects a manipulated 'context' parameter to bypass authorization checks associated with the specific user ID.
6. The server processes the request and returns a JSON response containing the sensitive user profile data.
7. Attacker parses the response to exfiltrate email addresses, meta fields, and other user account details.

Impact

Successful exploitation results in the unauthorized disclosure of sensitive user account information. This data can facilitate further targeted attacks, such as account takeover via credential stuffing, spear-phishing campaigns against administrators, or broader reconnaissance for additional system compromise. The scope of impact is limited to the user information stored within the WordPress database, but the ability to perform this unauthenticated and programmatically increases the risk of large-scale data harvesting.

Recommendation

Prioritized actions for security teams:

• Update the Kirki plugin to the latest version, ensuring all installations are at least version 6.3.3 or higher.
• Audit logs for repeated REST API requests targeting user profiles if anomalous patterns are observed.
• Review all WordPress pages and templates for the use of dynamic user-type content blocks if patching cannot be performed immediately.
• Disable the REST API for public-facing components if the site's functionality does not require it, to mitigate enumeration and exploitation of IDOR vulnerabilities.