Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2026-8206 EUVD-2026-33881GHSA-gr32-6rr4-7px2

Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'

Published Jun 2, 2026 · Updated Jun 2, 2026 · Assigned by Wordfence

Vendor: Themeum Product: Kirki – Freeform Page Builder, Website Builder & Customizer Category: Web / CMS

Description

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.

Affected products

VendorProductAffectedFixed
themeum Kirki – Freeform Page Builder, Website Builder & Customizer 6.0.0 – ≤ 6.0.6 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 5 repositories

  • Sanjith1236/CVE-2026-8206-Kirki-Exploit-Analysis ★ 3 · Oct 6, 2026

    A deep-dive technical reconstruction and impact analysis of CVE-2026-8206—a critical CVSS 9.8 unauthenticated account takeover vulnerability in the WordPress Kirki plugin, featuring proof-of-concept …

  • Jenderal92/CVE-2026-8206 ★ 3 · Jun 2, 2026

    Mass exploitation tool for CVE-2026-8206 – Unauthenticated Privilege Escalation via 'handle_forgot_password' in Kirki WordPress plugin (≤6.0.6).

  • Dungsocool/CVE-2026-8206 ★ 1 · Jul 28, 2026

    CVE-2026-8206: Kirki Customizer Framework - Unauthenticated Account Takeover (CVSS 9.8)

  • izxci/CVE-2026-8206 ★ 0 · Jun 17, 2026

    CVE-2026-8206 Kirki Plugin Unauthenticated Account Takeover Exploit

  • rootdirective-sec/CVE-2026-8206-Lab ★ 0 · Jun 5, 2026

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References