CVE-2026-8206
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress versions 6.0.0 to 6.0.6 is vulnerable to privilege escalation via account takeover. The plugin accepts an arbitrary email address when a username is used in the password reset request, allowing unauthenticated attackers to send a password reset link to their own email.
Risk Assessment
An unauthenticated attacker can take over any user account registered on the site, potentially leading to privilege escalation and site compromise.
Recommendation
Update the Kirki plugin to version 6.0.7 or later that fixes this vulnerability. If not available, temporarily disable the plugin.
Original NVD description (English source)
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.