CVE-2026-8206
Privilege Escalation via Account Takeover in Kirki Plugin
Publication date: 2026-06-02
Last updated on: 2026-06-02
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kirki | freeform_page_builder | From 6.0.0 (inc) to 6.0.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress has a vulnerability that allows privilege escalation through account takeover. Specifically, in versions 6.0.0 to 6.0.6, the plugin accepts an arbitrary email address when a username is submitted in a password reset request. This flaw enables unauthenticated attackers to send a password reset link for any registered user to an email address they control.
How can this vulnerability impact me? :
This vulnerability can have severe impacts as it allows attackers to take over accounts without authentication. By sending password reset links to their own email, attackers can gain unauthorized access to user accounts, potentially leading to full control over the affected WordPress site. The CVSS score of 9.8 indicates a critical severity with high impact on confidentiality, integrity, and availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to take over accounts by sending password reset links to arbitrary email addresses. This can lead to unauthorized access to user data, which may result in violations of data protection regulations such as GDPR and HIPAA that require safeguarding personal and sensitive information.
Specifically, the compromise of user accounts could lead to breaches of confidentiality, integrity, and availability of personal data, potentially causing non-compliance with these standards.