Actively Exploited Kirki Flaw Enables WordPress Account Takeovers
Summary
Wordfence reports active exploitation of CVE-2026-8206, a Kirki plugin flaw that lets unauthenticated attackers send password reset links to their own email addresses. Versions through 6.0.6 are affected; upgrade to 6.0.7 or disable the plugin.
Key points
- CVE-2026-8206 affects Kirki – Freeform Page Builder, Website Builder & Customizer versions through 6.0.6.
- The unauthenticated flaw lets attackers request a reset link for a user account and have it sent to an attacker-controlled email address.
- Wordfence reports active exploitation and says its firewall blocked more than 222 attempts against customers in 24 hours.
- The vulnerability was introduced in Kirki 6.0.0 and exposed a custom REST API password-reset endpoint.
- The developer released a fix in version 6.0.7; administrators should upgrade or disable the plugin.
- Successful administrator account takeover could enable malicious plugin installation, website modification, or access to private databases.
Article Details
- Vulnerability Types
- Privilege escalation
- Severity
- Critical
- Affected Versions
- Kirki 6.0.0–6.0.6
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Upgrade to version 6.0.7.
- Disable the plugin.