9.8 CriticalCWE-269
CVE-2026-8206
Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
themeumKirki – Freeform Page Builder, Website Builder & Customizer
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 25 Oct
1.3%probability of exploitation in the next 30 days
Higher than 70% of scored CVEs
SeverityCVSS
9.8Critical
Description NVD
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.
Coverage 1 article · 1 outlet
- CVE-2026-8206: Kirki flaw lets attackers hijack WordPress adminsSecurityOnline · first in our coverage