The vulnerability is an insecure direct object reference that allows an unauthenticated user to retrieve arbitrary profile information. By supplying a crafted 'context' value, an attacker can trigger the plugin to expose user identifiers and personal data such as email, display name, registration date, avatar URL, and text-based meta fields. The weakness is an example of Information Disclosure via an insufficiently validated gain of access – CWE-639.

The issue affects the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin from themeum, specifically all plugin releases up to and including 6.3.2. Sites that host pages using Kirki templates containing user-type dynamic content blocks are vulnerable.

The CVSS score of 7.5 indicates high severity, but no EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw without authentication by targeting any published page that uses a Kirki template. Target user IDs are enumerated via standard WordPress REST endpoints, which means the only prerequisite is the presence of an exposed template on the site. The lack of authentication requirements and the ability to programmatically obtain sensitive data make this vulnerability readily exploitable in practice.