# WordPress Kirki Plugin CVE-2026-8206 — Unauthenticated Account Takeover via Password-Reset Email Hijack (Active Exploitation, ~500K Sites)

> CVE-2026-8206 is a critical (CVSS 9.8) unauthenticated privilege-escalation flaw in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (versions 6.0.0-6.0.6). The plugin's handle_forgot_password() REST endpoint accepts an attacker-supplied email address during a password-reset request and delivers a valid reset link for any named user — including administrators — to that attacker-controlled inbox. Wordfence blocked 222+ exploitation attempts in 24 hours; the plugin is active on roughly 500,000 sites.

- **Published:** 2026-06-02T00:00:00Z
- **Last reviewed:** 2026-06-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0666
- **ID:** TL-2026-0666
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-8206

## Description

CVE-2026-8206 is an unauthenticated account-takeover vulnerability in the WordPress plugin 'Kirki - Freeform Page Builder, Website Builder & Customizer', present in versions 6.0.0 through 6.0.6 and fixed in 6.0.7. The plugin registers a custom REST API endpoint backed by the handle_forgot_password() function to drive its front-end password-reset flow. The flaw is a broken password-recovery mechanism (CWE-640): when a password-reset request supplies a valid WordPress username together with an arbitrary email address, the plugin generates a legitimate WordPress reset key for that account and emails the reset link to the attacker-supplied address instead of validating it against the account's registered email. The endpoint requires no authentication and no user interaction.

Exploitation is trivial and fully unauthenticated. An attacker first enumerates a target username (WordPress exposes authors via /wp-json/wp/v2/users, ?author=N redirects, REST author archives, or sitemap/author pages), then issues a single HTTP request to the plugin's password-reset route specifying the victim username and an attacker-controlled email. The plugin returns a valid reset link to the attacker, who completes the reset and authenticates as that user. Targeting the site administrator yields full wp-admin access.

Post-compromise, administrator access enables installation of malicious or trojanized plugins/themes, injection of PHP web shells for persistent backdoor access (e.g., via the plugin/theme editor or a crafted plugin upload), modification of site content for SEO spam or malicious redirects, creation of rogue administrator accounts for persistence, and direct access to the WordPress database (user PII, hashes, secrets). This mirrors the standard mass-compromise WordPress kill chain in which a single unauthenticated flaw is automated across hundreds of thousands of sites.

The vulnerability was reported to Wordfence by researcher CHOIGYENGMIN on 2026-05-04; the Kirki maintainers were notified on 2026-05-16 and released the patched version 6.0.7 on 2026-05-18, which corrects the reset flow to validate that the supplied email matches the target account before issuing a reset link. Public disclosure followed on 2026-06-01/02 (Patchstack, Wordfence, BleepingComputer). Wordfence reported blocking over 222 exploitation attempts against its customers within a 24-hour window, confirming active in-the-wild exploitation. Affected versions were estimated to be running on nearly 40% of the plugin's ~500,000 active installations at disclosure.

## MITRE ATT&CK

- T1595 Active Scanning
- T1589 Gather Victim Identity Information
- T1087 Account Discovery
- T1190 Exploit Public-Facing Application
- T1212 Exploitation for Credential Access
- T1606 Forge Web Credentials
- T1068 Exploitation for Privilege Escalation
- T1098 Account Manipulation
- T1136 Create Account
- T1505 Server Software Component
- T1059 Command and Scripting Interpreter
- T1036 Masquerading
- T1213 Data from Information Repositories
- T1491 Defacement

## Sources

- [Critical Kirki flaw exploited to hijack WordPress admin accounts](https://www.bleepingcomputer.com/news/security/critical-kirki-flaw-exploited-to-hijack-wordpress-admin-accounts/)
- [Unauthenticated Privilege Escalation Vulnerability Patched in Kirki WordPress Plugin](https://www.wordfence.com/blog/2026/06/unauthenticated-privilege-escalation-vulnerability-patched-in-kirki-wordpress-plugin/)
- [WordPress Kirki Plugin 6.0.0-6.0.6 - Unauthenticated Privilege Escalation via handle_forgot_password](https://patchstack.com/database/wordpress/plugin/kirki/vulnerability/wordpress-kirki-plugin-6-0-0-6-0-6-unauthenticated-privilege-escalation-via-handle-forgot-password-vulnerability)
- [CVE-2026-8206 Detail](https://www.tenable.com/cve/CVE-2026-8206)
- [CVE-2026-8206 - Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation](https://cvefeed.io/vuln/detail/CVE-2026-8206)
- [WordPress plugin hole enables account takeover](https://www.csoonline.com/article/4085234/wordpress-plugin-hole-enables-account-takeover.html)
- [Critical Site Takeover Flaw Affects WordPress Sites](https://www.darkreading.com/vulnerabilities-threats/critical-site-takeover-flaw-400k-wordpress-sites)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0666