CVE-2026-8206
Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
CRITICAL 9.8EPSS 0.8%
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.
- Affected
- themeum · Kirki – Freeform Page Builder, Website Builder & Customizer
- CVSS v3.1 WORDFENCE
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 0.77% chance of exploitation in the next 30 days, 55th percentile
- Published
- 2026-06-02
Proof-of-concept exploits (5)
- izxci/CVE-2026-82060★ · 2026-06-17
- Dungsocool/CVE-2026-82061★ · 2026-07-28
- HackfutSecRoot/multi_exploit_wp4★ · 2026-08-26
- Jenderal92/CVE-2026-82063★ · 2026-06-02
- Sanjith1236/CVE-2026-8206-Kirki-Exploit-Analysis/blob/87710491970443753a2ac757f4f847c355b…3★ · 2026-10-06