The Kirki – Freeform Page Builder

CVE-2026-8206 is an unauthenticated account-takeover flaw in the Kirki WordPress plugin's custom password-reset REST flow. In affected versions 6.0.0 through 6.0.6, the handle_forgot_password() logic will generate a valid reset link for the username you name, but send that link to the attacker-supplied email address instead of the account owner's real mailbox. That turns a public-facing form into arbitrary user takeover, including administrator accounts.

The vendor's 9.8/CRITICAL rating is basically fair in real deployments. The main downward pressure is exposure narrowing: the bug only exists in the recent 6.0.x branch, and Wordfence estimated roughly 150,000 vulnerable sites rather than the plugin's full 500,000+ install base. But the attack is still *unauthenticated, remote, low-friction, and already being exploited*, and WordPress admin compromise frequently becomes plugin install, backdoor drop, and full site control.

Why this verdict

• Unauthenticated remote path: no prior foothold, no credentials, and no user interaction are required once the site is exposed and running vulnerable Kirki.
• Active exploitation overrides low EPSS: live abuse reported on June 2, 2026 matters more than a stale low predictive score.
• Recent-version narrowing trims the score slightly: only 6.0.0-6.0.6 are affected, and Wordfence estimates ~150,000 vulnerable sites rather than the whole install base.
• Blast radius is usually full site control: WordPress admin compromise often becomes malicious plugin install, persistent admin creation, content tampering, credential theft, or web-shell deployment.
• Modern controls may help but are uneven: WordPress-specific WAF rules from Wordfence/Patchstack can block this, but many self-hosted sites lack tuned virtual patching or audit coverage.

Why not higher?

This is not a 10.0-class universal internet worm. The reachable population is narrowed by the requirement for a specific plugin and a specific recent version branch, and some sites will already be shielded by WordPress-aware WAF rules. Those are real friction points, so 9.6 is aggressive enough without pretending every WordPress site is equally exposed.

Why not lower?

Because the attacker does not need auth, phishing, local access, or a chained bug. The exploit path is short, the target class is massively deployed, and there is already exploitation evidence. Once an admin account falls, defenders should assume immediate site compromise is one click away.

1. Block the vulnerable password-reset route — Deploy a WAF or reverse-proxy rule that blocks requests hitting Kirki's custom forgot-password REST workflow, especially those invoking handle_forgot_password, immediately, within hours because exploitation is active. This is the fastest containment move for sites that cannot patch in the same maintenance window.
2. Update Kirki to 6.0.7+ — Roll the vendor fix to every exposed WordPress estate running Kirki, prioritizing internet-facing production sites and shared hosting first. Because this is a CRITICAL verdict with active exploitation, do this on an emergency basis rather than waiting for normal monthly plugin maintenance.
3. Hunt for post-takeover artifacts — Review WordPress audit logs, mail logs, new administrator creation, plugin/theme install events, modified PHP files, and suspicious outbound mail immediately, within hours on any site that was internet-exposed and unpatched after 2026-05-18. This flaw's natural post-exploitation outcome is silent persistence, not noisy crashing.
4. Rotate high-value WordPress credentials — Force password resets for administrator accounts and revoke active sessions on sites that were exposed while vulnerable, especially if you lack request logs. Do this immediately, within hours for suspected targets, because the exploit path specifically abuses password reset state.

Run this on the WordPress host or inside the container/VM that holds the site files. Invoke it as sudo ./check_kirki_cve_2026_8206.sh /var/www/html with read access to the WordPress directory; it uses wp-cli if present and falls back to parsing the plugin header from disk.

#!/usr/bin/env bash
# check_kirki_cve_2026_8206.sh
# Detects whether a local WordPress site is running a vulnerable Kirki version.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

WP_PATH="${1:-}"
if [[ -z "$WP_PATH" ]]; then
  echo "UNKNOWN - usage: $0 /path/to/wordpress"
  exit 2
fi

if [[ ! -d "$WP_PATH" ]]; then
  echo "UNKNOWN - path does not exist: $WP_PATH"
  exit 2
fi

version=""
plugin_main=""

# Try WP-CLI first
if command -v wp >/dev/null 2>&1; then
  version=$(wp --path="$WP_PATH" plugin get kirki --field=version 2>/dev/null || true)
fi

# Fallback: locate plugin file and parse Version header
if [[ -z "$version" ]]; then
  for f in \
    "$WP_PATH/wp-content/plugins/kirki/kirki.php" \
    "$WP_PATH/wp-content/plugins/kirki/index.php" \
    "$WP_PATH/wp-content/plugins/kirki/loader.php"; do
    if [[ -f "$f" ]]; then
      plugin_main="$f"
      break
    fi
  done

  if [[ -n "$plugin_main" ]]; then
    version=$(grep -iE '^\s*Version:' "$plugin_main" 2>/dev/null | head -n1 | sed -E 's/^\s*Version:\s*//I' | tr -d '\r')
  fi
fi

if [[ -z "$version" ]]; then
  echo "UNKNOWN - Kirki plugin not detected or version unreadable"
  exit 2
fi

# Normalize version string
version=$(echo "$version" | awk '{print $1}')

verlte() {
  [ "$1" = "$2" ] && return 0
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

vergte() {
  [ "$1" = "$2" ] && return 0
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

if vergte "$version" "6.0.0" && verlte "$version" "6.0.6"; then
  echo "VULNERABLE - Kirki version $version is within 6.0.0-6.0.6"
  exit 1
fi

if vergte "$version" "6.0.7"; then
  echo "PATCHED - Kirki version $version is 6.0.7 or later"
  exit 0
fi

if verlte "$version" "5.999.999"; then
  echo "PATCHED - Kirki version $version predates the affected 6.0.x branch"
  exit 0
fi

echo "UNKNOWN - unable to classify Kirki version $version"
exit 2

Sources

1. Wordfence blog: Unauthenticated Privilege Escalation Vulnerability Patched in Kirki WordPress Plugin
2. WordPress.org Kirki plugin page
3. Patchstack advisory for Kirki CVE-2026-8206
4. BleepingComputer report on active exploitation
5. Rapid7 vulnerability database entry
6. CISA Known Exploited Vulnerabilities Catalog
7. CVE record