Authorization Bypass in Kirki Page Builder Plugin for WordPress

CVE-2026-18347

What is CVE-2026-18347?

The Kirki Page Builder plugin for WordPress is susceptible to an authorization bypass, allowing authenticated attackers with custom-level access to exploit the vulnerability. This weakness stems from the inadequate verification of user authorization when performing specific actions. As a result, attackers can access sensitive information, including arbitrary user metadata and crucial user fields, such as email addresses, user roles, registration dates, and additional metadata, by manipulating requests to the frontend collection endpoint.

References