Datist Pham

**Name of the Vulnerable Software and Affected Versions** Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.1.2 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with custom-level access or higher can read arbitrary user metadata and sensitive record fields, such as email addresses, assigned roles, registration dates, and `user meta` values, for any WordPress user, including administrators. This is achieved by providing a target user ID with a user-type context to the frontend collection endpoint via the `context` parameter. **Recommendations** Update the plugin to a version newer than 6.1.1.