The vulnerability exists in the Kirki plugin for WordPress and allows an authenticated user with a custom-level role or higher to bypass authorization checks. By supplying a 'context' parameter and target user ID to the frontend collection endpoint, the attacker can read arbitrary user metadata, including email addresses, roles, registration dates, and other user_meta data for any user, including administrators. The weakness stems from missing authorization (CWE-862) and results in the disclosure of confidential user information.

The attack affects sites running the Kirki plugin version 6.1.1 or earlier, which are included in the Freeform Page Builder, Website Builder & Customizer plugin family by themeum. Any WordPress installation using these versions is vulnerable. No further version specification is provided beyond 6.1.1, but all earlier releases carry the same flaw.

The CVSS score is 4.3, indicating moderate severity, and the EPSS score is not available, so no current exploitation probability is reported. The vulnerability is not listed in the CISA KEV catalog. An attacker must first authenticate to WordPress with a role of subscriber+ (custom or higher). Once authenticated, they can leverage the vulnerable endpoint to obtain sensitive information for any user. This attack requires prior knowledge of a valid user ID and the ability to send requests to the plugin’s API endpoints. While it does not lead to code execution or privilege escalation, the exposure of personal data could facilitate further social engineering or phishing attacks.