CVE-2026-8206
Deferred Deferred - Pending Action

Privilege Escalation via Account Takeover in Kirki Plugin

Publication date: 2026-06-02

Last updated on: 2026-06-02

Assigner: Wordfence

Description
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-02
Last Modified
2026-06-02
Generated
2026-07-12
AI Q&A
2026-06-02
EPSS Evaluated
2026-07-11
NVD
CVE-2026-8206
EUVD
EUVD-2026-33881

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kirki freeform_page_builder From 6.0.0 (inc) to 6.0.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress has a vulnerability that allows privilege escalation through account takeover. Specifically, in versions 6.0.0 to 6.0.6, the plugin accepts an arbitrary email address when a username is submitted in a password reset request. This flaw enables unauthenticated attackers to send a password reset link for any registered user to an email address they control.

Impact Analysis

This vulnerability can have severe impacts as it allows attackers to take over accounts without authentication. By sending password reset links to their own email, attackers can gain unauthorized access to user accounts, potentially leading to full control over the affected WordPress site. The CVSS score of 9.8 indicates a critical severity with high impact on confidentiality, integrity, and availability.

Compliance Impact

The vulnerability allows unauthenticated attackers to take over accounts by sending password reset links to arbitrary email addresses. This can lead to unauthorized access to user data, which may result in violations of data protection regulations such as GDPR and HIPAA that require safeguarding personal and sensitive information.

Specifically, the compromise of user accounts could lead to breaches of confidentiality, integrity, and availability of personal data, potentially causing non-compliance with these standards.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8206. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart