Attackers Target Vulnerabilities in Kirki and Burst Statistics WordPress Plugins
Summary
Defiant says it blocked thousands of attacks targeting flaws in Kirki and Burst Statistics WordPress plugins. The bugs can enable administrator account takeover; updates are available for both plugins.
Key points
- Kirki versions 6.0.0–6.0.6 are affected by CVE-2026-8206, a password-reset flaw that can let unauthenticated attackers take over an account using an attacker-controlled email address.
- Kirki version 6.0.7 or newer contains a patch for CVE-2026-8206.
- Burst Statistics versions 3.4.0–3.4.1.1 have an authentication bypass that can grant unauthenticated attackers administrator-level REST API access.
- The Burst Statistics flaw stems from incorrect validation of application passwords in the Authorization header; version 3.4.2 or newer contains a patch.
- Defiant says it blocked thousands of attacks targeting the vulnerabilities in the previous 24 hours.
- Defiant estimates about 150,000 sites run a vulnerable Kirki version; Burst Statistics has more than 200,000 active installations.
Article Details
- Vulnerability Types
- Unauthenticated privilege escalation and account takeover
- Authentication bypass
- Severity
- CVE-2026-8206 has a CVSS score of 9.8; severity for the Burst Statistics vulnerability is not stated.
- Affected Versions
- Kirki 6.0.0 to 6.0.6
- Burst Statistics 3.4.0 to 3.4.1.1
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1098 · Account ManipulationThe Burst Statistics authentication bypass could let an unauthenticated attacker use administrator-level REST API functionality, including creating a new administrator account.T1190 · Exploit Public-Facing ApplicationAttackers targeted vulnerable WordPress plugins; the article reports thousands of attacks against these vulnerabilities in the past 24 hours.
CVE
Vendors
Products
Burst StatisticsHundreds of thousands of websites are potentially exposed to attacks exploiting two vulnerabilities in the Kirki and Burst Statistics WordPress plugins, Defiant warns.KirkiHundreds of thousands of websites are potentially exposed to attacks exploiting two vulnerabilities in the Kirki and Burst Statistics WordPress plugins, Defiant warns.WordPressHundreds of thousands of websites are potentially exposed to attacks exploiting two vulnerabilities in the Kirki and Burst Statistics WordPress plugins, Defiant warns.