Threat reportVulnerabilityTL-2026-0666
WordPress Kirki Plugin CVE-2026-8206 — Unauthenticated Account Takeover via Password-Reset Email Hijack (Active Exploitation, ~500K Sites)
WordPress Kirki Plugin CVE-2026-8206 (TL-2026-0666), also tracked as Kirki Password-Reset Hijack, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-06-02. It has no confirmed attribution, affects Themeisle / Kirki Team Kirki - Freeform Page Builder, Website Builder, references 1 CVE (CVE-2026-8206), maps to 14 MITRE ATT&CK techniques (T1036, T1059, T1068), and is covered by 9 detection rules and 12 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 14MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-0666
- Threat ID
- TL-2026-0666
- Also known as
- Kirki Password-Reset Hijack, Kirki handle_forgot_password Account Takeover
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, ecommerce, media, small-business, education, hospitality, nonprofit
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
How WordPress Kirki Plugin CVE-2026-8206 works
CVE-2026-8206 is a critical (CVSS 9.8) unauthenticated privilege-escalation flaw in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (versions 6.0.0-6.0.6). The plugin's handle_forgot_password() REST endpoint accepts an attacker-supplied email address during a password-reset request and delivers a valid reset link for any named user — including administrators — to that attacker-controlled inbox. Wordfence blocked 222+ exploitation attempts in 24 hours; the plugin is active on roughly 500,000 sites.
CVE-2026-8206 is an unauthenticated account-takeover vulnerability in the WordPress plugin 'Kirki - Freeform Page Builder, Website Builder & Customizer', present in versions 6.0.0 through 6.0.6 and fixed in 6.0.7. The plugin registers a custom REST API endpoint backed by the handle_forgot_password() function to drive its front-end password-reset flow. The flaw is a broken password-recovery mechanism (CWE-640): when a password-reset request supplies a valid WordPress username together with an arbitrary email address, the plugin generates a legitimate WordPress reset key for that account and emails the reset link to the attacker-supplied address instead of validating it against the account's registered email. The endpoint requires no authentication and no user interaction.
Exploitation is trivial and fully unauthenticated. An attacker first enumerates a target username (WordPress exposes authors via /wp-json/wp/v2/users, ?author=N redirects, REST author archives, or sitemap/author pages), then issues a single HTTP request to the plugin's password-reset route specifying the victim username and an attacker-controlled email. The plugin returns a valid reset link to the attacker, who completes the reset and authenticates as that user. Targeting the site administrator yields full wp-admin access.
Post-compromise, administrator access enables installation of malicious or trojanized plugins/themes, injection of PHP web shells for persistent backdoor access (e.g., via the plugin/theme editor or a crafted plugin upload), modification of site content for SEO spam or malicious redirects, creation of rogue administrator accounts for persistence, and direct access to the WordPress database (user PII, hashes, secrets). This mirrors the standard mass-compromise WordPress kill chain in which a single unauthenticated flaw is automated across hundreds of thousands of sites.
The vulnerability was reported to Wordfence by researcher CHOIGYENGMIN on 2026-05-04; the Kirki maintainers were notified on 2026-05-16 and released the patched version 6.0.7 on 2026-05-18, which corrects the reset flow to validate that the supplied email matches the target account before issuing a reset link. Public disclosure followed on 2026-06-01/02 (Patchstack, Wordfence, BleepingComputer). Wordfence reported blocking over 222 exploitation attempts against its customers within a 24-hour window, confirming active in-the-wild exploitation. Affected versions were estimated to be running on nearly 40% of the plugin's ~500,000 active installations at disclosure.
MITRE ATT&CK techniques used in TL-2026-0666
Defense Evasion
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Discovery
Persistence
T1098 Account Manipulation; T1136 Create Account; T1505 Server Software Component
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1212 Exploitation for Credential Access; T1606 Forge Web Credentials
Collection
T1213 Data from Information Repositories
Impact
Reconnaissance
T1589 Gather Victim Identity Information; T1595 Active Scanning
Affected products and versions in WordPress Kirki Plugin CVE-2026-8206
- Themeisle / Kirki Team — Kirki - Freeform Page Builder, Website Builder & Customizer (WordPress plugin)
Vulnerable versions: 6.0.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; 6.0.5; 6.0.6
Fixed in: 6.0.7
Remediation for WordPress Kirki Plugin CVE-2026-8206
Patches
- Kirki 6.0.7 (released 2026-05-18) — validates that the supplied email matches the target user before issuing a password-reset link.
Immediate actions
- Update the Kirki plugin to version 6.0.7 or later on all WordPress sites immediately.
- Audit wp_users for unexpected administrator accounts and recently-changed passwords; force a password reset for all administrators.
- Review the wp_usermeta / user_activation_key state and recent password-reset emails for resets delivered to unknown external addresses.
- If running an affected version and update is not immediately possible, deactivate the Kirki plugin until patched.
Workarounds
- Deactivate the Kirki plugin on affected versions until 6.0.7 can be applied.
- Block POST requests to the plugin's password-reset REST route at the WAF/reverse proxy until patched.
Longer-term hardening
- Deploy a WordPress WAF (e.g., Wordfence) with virtual patching to block exploitation of the password-reset endpoint.
- Restrict or monitor REST API user-enumeration vectors (/wp-json/wp/v2/users, ?author= redirects).
- Implement file-integrity monitoring on wp-content/plugins and wp-content/themes to catch web-shell or trojanized-plugin deployment.
- Enforce two-factor authentication on all administrator accounts so a stolen reset link alone is insufficient for takeover.
CVEs associated with WordPress Kirki Plugin CVE-2026-8206
Weaknesses (CWE) in WordPress Kirki Plugin CVE-2026-8206
Timeline of WordPress Kirki Plugin CVE-2026-8206
- Security researcher CHOIGYENGMIN reports the unauthenticated password-reset account-takeover flaw in Kirki to Wordfence.
- Kirki plugin maintainers notified of the vulnerability and provided technical details.
- Kirki version 6.0.7 released, fixing handle_forgot_password() to validate the supplied email against the target account before issuing a reset link.
- CVE-2026-8206 publicly disclosed via Patchstack and CVE databases (CVSS 9.8).
- Wordfence reports blocking over 222 in-the-wild exploitation attempts against its customers within a 24-hour window.
- Wordfence, BleepingComputer, CSO Online and Dark Reading publish coordinated analysis; plugin reported active on ~500,000 sites with ~40% on affected versions.
Sources cited for WordPress Kirki Plugin CVE-2026-8206
- Critical Kirki flaw exploited to hijack WordPress admin accounts
- Unauthenticated Privilege Escalation Vulnerability Patched in Kirki WordPress Plugin
- WordPress Kirki Plugin 6.0.0-6.0.6 - Unauthenticated Privilege Escalation via handle_forgot_password
- CVE-2026-8206 Detail
- CVE-2026-8206 - Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation
- WordPress plugin hole enables account takeover
- Critical Site Takeover Flaw Affects WordPress Sites
Detection coverage for TL-2026-0666
As of 2026-06-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0666 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.