CVE-2026-107762 | CVSS: 7.5 | 严重级别: HIGH
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary users' sensitive profile data — including email address, display name, nicename, registration date, profile image URL, and any string-valued user meta fields such as first name, last name, nickname, description, and custom meta keys — via the REST response. Exploitati
参考链接:
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.2/includes/API/Fronten
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.2/includes/API/Fronten
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.2/includes/Frontend/Pr
📌 数据来源: NVD 官方