Critical Vulnerability in WordPress Plugin - Kirki Actively Exploited

Executive Summary

A critical unauthenticated privilege escalation vulnerability was discovered in the Kirki WordPress plugin. The flaw exists in the password reset mechanism and allows an unauthenticated attacker to take over arbitrary user accounts, including administrator accounts.

Key Details

Affected Platform

Kirki WordPress plugin

Attack Surface

Recommended Action

Apply vendor patch

Affected Environment

WordPress sites running the Kirki plugin versions 6.0.0 through 6.0.6. The plugin is installed on over 500,000 WordPress sites; approximately 150,000 were running vulnerable versions at time of publication.

Operational Impact

Full administrative takeover of affected WordPress sites is possible without any credentials. Attackers can install backdoors and malicious plugins, inject web shells, modify or delete content, exfiltrate user data and site content, and maintain persistent control. Service disruption, data exposure, and full infrastructure compromise are all plausible outcomes.

Technical Root Cause

CVE-2026-8206 (CVSS 9.8) - The vulnerability originates in the handle_forgot_password() function within the CompLibFormHandler class. The custom REST API endpoint for password resets accepts an attacker-supplied email address instead of using the account's registered email. By sending a crafted password reset request containing a target username and an attacker-controlled email address, an attacker receives the password reset link and gains full access to the targeted account. No authentication is required at any step.

Recommended Mitigation

Upgrade the Kirki plugin to version 6.0.7 or later immediately.
The vulnerability is fully addressed in the patched release.
Review all user accounts and privilege assignments for unauthorized accounts, suspicious password resets, or unexpected permission changes.
Audit website files, plugins, and themes for unauthorized modifications, malicious uploads, or web shells.
Deploy and maintain Web Application Firewall protections to detect and block malicious requests targeting the password reset REST API endpoint.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Explore Managed Detection and Response

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

Wordfence Blog - Unauthenticated Privilege Escalation Vulnerability Patched in Kirki WordPress Plugin. Orca Security Blog - Kirki WordPress Plugin Vulnerability CVE-2026-8206. CVE Record: CVE-2026-8206.