CVE-2026-8206
Deferred Deferred - Pending Action
Privilege Escalation via Account Takeover in Kirki Plugin

Publication date: 2026-06-02

Last updated on: 2026-06-02

Assigner: Wordfence

Description
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-02
Last Modified
2026-06-02
Generated
2026-06-22
AI Q&A
2026-06-02
EPSS Evaluated
2026-06-21
NVD
CVE-2026-8206
EUVD
EUVD-2026-33881
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
kirki freeform_page_builder From 6.0.0 (inc) to 6.0.6 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress has a vulnerability that allows privilege escalation through account takeover. Specifically, in versions 6.0.0 to 6.0.6, the plugin accepts an arbitrary email address when a username is submitted in a password reset request. This flaw enables unauthenticated attackers to send a password reset link for any registered user to an email address they control.

Impact Analysis

This vulnerability can have severe impacts as it allows attackers to take over accounts without authentication. By sending password reset links to their own email, attackers can gain unauthorized access to user accounts, potentially leading to full control over the affected WordPress site. The CVSS score of 9.8 indicates a critical severity with high impact on confidentiality, integrity, and availability.

Compliance Impact

The vulnerability allows unauthenticated attackers to take over accounts by sending password reset links to arbitrary email addresses. This can lead to unauthorized access to user data, which may result in violations of data protection regulations such as GDPR and HIPAA that require safeguarding personal and sensitive information.

Specifically, the compromise of user accounts could lead to breaches of confidentiality, integrity, and availability of personal data, potentially causing non-compliance with these standards.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8206. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart