CVE-2026-107762 themeum CVE debrief

Who should care

Defenders responsible for WordPress deployments using the Kirki plugin, particularly those with user-type dynamic content blocks, should assess exposure and prioritize verification of published pages and user IDs.

Why it matters

CVE-2026-107762 is a high-severity vulnerability in the Kirki plugin for WordPress, allowing unauthenticated attackers to expose sensitive user profile data. Defenders should prioritize verification of published pages, assess exposure of user IDs, and update the Kirki plugin to ensure the latest security patches are applied.

• Potential exposure of sensitive user profile data
• Verification of published pages using Kirki templates with user-type dynamic content blocks
• Assessment of user ID exposure via standard WordPress REST endpoints
• Prioritization of Kirki plugin updates to ensure latest security patches

Technical summary

The Kirki plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 6.3.2. This vulnerability allows unauthenticated attackers to expose arbitrary users' sensitive profile data via the REST response when a published page uses a Kirki template containing at least one user-type dynamic content block. The vulnerability is confirmed in Kirki plugin versions up to and including 6.3.2. Defenders should prioritize verifying the presence of published pages using Kirki templates with user-type dynamic content blocks and assess exposure of user IDs via standard WordPress REST endpoints.

Defensive priority

Defenders should prioritize verifying the presence of published pages using Kirki templates with user-type dynamic content blocks and assess exposure of user IDs via standard WordPress REST endpoints.

Recommended defensive actions

• Verify the presence of published pages using Kirki templates with user-type dynamic content blocks
• Assess exposure of user IDs via standard WordPress REST endpoints
• Review and update Kirki plugin versions to ensure the latest security patches are applied
• Monitor for potential exposure of sensitive user profile data
• Perform asset inventory of WordPress deployments using the Kirki plugin
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability is confirmed in Kirki plugin versions up to and including 6.3.2. The CVE record and NVD entry provide details on the vulnerability, but additional verification is required to determine the full scope of affected versions and deployments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.