Kirki WordPress Plugin EUVD-2026-33881

Exploitation requires (1) the target WordPress site to have Kirki Freeform Page Builder version 6.0.0-6.0.6 installed and active with its front-end password reset form reachable, and (2) the attacker to know or enumerate a valid username on the site (administrator usernames are the high-value target and are commonly exposed via /wp-json/wp/v2/users, /?author=N redirects, or author archive pages). No authentication, no user interaction from the victim, and no non-default plugin configuration are required - the vulnerable code path is the default password-reset handler shipped with the affected versions. Limiting factors: sites that have disabled user enumeration, restricted the plugin's reset endpoint via WAF, or use email-based login only may raise the bar, but none of these are default WordPress hardening.

The CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is well-justified: exploitation is remote, requires no authentication, no user interaction, and yields full administrator takeover when an admin username is known - and WordPress administrator usernames are often enumerable via author archives, REST API (/wp-json/wp/v2/users), or login error timing. SSVC mapping would likely score Exploitation=PoC-likely, Automatable=YES (single HTTP request, scriptable across discovered Kirki installs), Technical Impact=Total. EPSS and KEV data are not provided in the input, so real-world exploitation prevalence cannot be quantified yet, but Wordfence-reported WordPress plugin flaws with trivial exploitation routinely see mass scanning within days of disclosure. The main mitigating factor is that the attacker must know or enumerate a valid username - a low bar on most WordPress deployments. This should be treated as a high-priority patch, not a paper tiger.

An attacker enumerates the administrator username of a target WordPress site via the public REST API or author archive, then submits a password reset request to the Kirki front-end handler supplying the admin username together with their own attacker@example.com email address. The plugin generates a valid reset token for the administrator account and emails the reset link to the attacker, who clicks it, sets a new password, and logs in as administrator - leading to full site compromise, plugin installation for persistence, and content or credential theft.