The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.
PoC: CVE-2026-8206-Kirki-Exploit-Analysis
A deep-dive technical reconstruction and impact analysis of CVE-2026-8206—a critical CVSS 9.8 unauthenticated account takeover vulnerability in the WordPress Kirki plugin, featuring proof-of-concept validation, detection strategies, and mitigation frameworks. 🛡️
[POC] CVE-2026-8206 — CVE-2026-8206-Kirki-WP
CVE-2026-8206 - Kirki WordPress Plugin Unauthenticated Account Takeover - PoC & Analysis | CVSS 9.8 CRITICAL | AMN SECURITY
[POC] CVE-2026-8206 — CVE-2026-8206
CVE-2026-8206 Kirki Plugin Unauthenticated Account Takeover Exploit
[POC] CVE-2026-8206 — CVE-2026-8206
Mass exploitation tool for CVE-2026-8206 – Unauthenticated Privilege Escalation via 'handle_forgot_password' in Kirki WordPress plugin (≤6.0.6).
PoC: CVE-2026-8206
CVE-2026-8206: Kirki Customizer Framework - Unauthenticated Account Takeover (CVSS 9.8)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free