What is the CVSS score of CVE-2026-8206?

CVE-2026-8206 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Kirki WordPress Plugin are affected by CVE-2026-8206?

The Kirki Freeform Page Builder WordPress plugin (versions 6.0.0-6.0.6) contains a critical account takeover vulnerability allowing unauthenticated attackers to hijack any registered account…

How to fix or mitigate CVE-2026-8206?

Within 24 hours: Audit all installed plugins for Kirki Freeform Page Builder versions 6.0.0-6.0.6 and immediately disable if found. Within 7 days: Conduct forensic analysis of admin account activity and password resets for signs of compromise; rotate all administrator account passwords and regenerate API tokens. Within 30 days: Complete transition to an alternative page builder solution; monitor vendor channels for any released patch to versions 6.0.7 or higher as contingency.

Kirki WordPress Plugin CVE-2026-8206

EUVD-2026-33881 CRITICAL

Improper Privilege Management (CWE-269)

2026-06-02 Wordfence

GHSA-gr32-6rr4-7px2

WordPress Privilege Escalation Wordpress Plugin Kirki Freeform Page Builder Website Builder Customizer Themeum

9.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 04:15 vuln.today

CVE Published

Jun 02, 2026 - 03:28 nvd

CRITICAL 9.8

DescriptionCVE.org

The Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.

AnalysisAI

Account takeover in the Kirki Freeform Page Builder WordPress plugin (versions 6.0.0 through 6.0.6) allows unauthenticated remote attackers to hijack any registered account, including administrators, by redirecting password reset links to attacker-controlled email addresses. The flaw stems from the plugin honoring an arbitrary email value supplied alongside a valid username in password reset requests, breaking the trust binding between account and recovery destination. No public exploit identified at time of analysis, but the trivial nature of the bug and Wordfence's published advisory make weaponization straightforward.

Technical ContextAI

The vulnerability resides in Kirki's ComponentLibrary password reset workflow (CompLibFormHandler.php and ElementGenerator.php), which implements a custom front-end password reset form rather than relying on WordPress core's wp_lostpassword_url() flow. Per the referenced source lines, the handler resolves the target user via the supplied username but then dispatches the reset email to a separately supplied 'email' parameter without verifying that the address matches the user's stored email. This is a textbook CWE-269 (Improper Privilege Management) manifestation realized through broken trust delegation - the recovery channel is attacker-controlled rather than user-controlled. Kirki is a widely deployed WordPress customizer and page-builder framework (themeum:kirki per CPE), so any site running an affected version with public registration or known usernames is exposed.

RemediationAI

Upstream fix available (changeset 3530843); released patched version not independently confirmed in the input, but the vulnerability spans through 6.0.6, so upgrade to the next published Kirki release (6.0.7 or later) as soon as it appears in the WordPress.org plugin repository - verify the installed version is greater than 6.0.6 in wp-admin > Plugins. As an immediate workaround, deactivate the Kirki plugin if the front-end customizer features are non-essential, which fully eliminates exposure but disables any Kirki-driven UI components on the site. If deactivation is not viable, restrict access to the plugin's password reset endpoint at the web server or WAF layer (Wordfence and similar WAFs typically ship a virtual patch shortly after Wordfence disclosure - confirm the rule is active), and harden username discoverability by disabling REST user enumeration and author archives. Forcing a site-wide password reset for administrators after patching is prudent given the silent nature of this takeover. Reference the Wordfence advisory and trac changeset above for vendor-confirmed details.