VulnSocial

CVE-2026-8206Active Exploitation

HIGHCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 12 mentions and remains active

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.

Back to dashboard
7.8/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-269

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

  • Active exploitation appears in 14 classified signals
  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 33 mentions across 10 observed days

What's happening

  • Active exploitation reported across 14 signals
  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 2 signals
  • Patch or workaround mentioned in 11 signals
  • Technical details provided in 28 signals
  • Disclosure: 8 classified signals
  • Peaked 9d ago at 12 mentions (2026-06-02); latest day: 1
  • 33 total mentions across 10 days

Deep dive

Activity timeline33 mentions / 10d
036912Mentions · 2026-06-02: 12Mentions · 2026-06-03: 10Mentions · 2026-06-04: 3Mentions · 2026-06-07: 2Mentions · 2026-06-11: 1Mentions · 2026-06-12: 1Mentions · 2026-06-16: 1Mentions · 2026-06-17: 1Mentions · 2026-06-22: 1Mentions · 2026-06-27: 1PoC Mentioned / Linked · 2026-06-03: 1PoC Mentioned / Linked · 2026-06-12: 1Exploit Tool / Code · 2026-06-12: 1Active Exploitation · 2026-06-02: 6Active Exploitation · 2026-06-03: 6Active Exploitation · 2026-06-04: 2Patch / Workaround · 2026-06-02: 5Patch / Workaround · 2026-06-03: 3Patch / Workaround · 2026-06-07: 1Patch / Workaround · 2026-06-16: 1Patch / Workaround · 2026-06-17: 1Technical Details · 2026-06-02: 11Technical Details · 2026-06-03: 8Technical Details · 2026-06-04: 3Technical Details · 2026-06-07: 1Technical Details · 2026-06-11: 1Technical Details · 2026-06-12: 1Technical Details · 2026-06-16: 1Technical Details · 2026-06-17: 1Technical Details · 2026-06-22: 106-0206-0306-0406-0706-1106-1206-1606-1706-2206-27
Signal classification5 categories
Active Exploitation
1442.4%
Disclosure
824.2%
Patch
515.2%
General
515.2%
PoC
13.0%
Referenced assets23 URLs
By indicator
Classification over time
DateTotalLabels
2026-06-0212
Active Exploitation6Disclosure4Patch2
2026-06-0310
Active Exploitation6Disclosure1General3
2026-06-043
Active Exploitation2Disclosure1
2026-06-072
General1Patch1
2026-06-111
Disclosure1
2026-06-121
PoC1
2026-06-161
Patch1
2026-06-171
Patch1
2026-06-221
General1
2026-06-271
Disclosure1
Full discourse20 posts
  • Sekurak@Sekurak
    Patch

    🚨 Krytyczna podatność w rozszerzeniu Kirki do WordPressa (CVE-2026-8206, CVSS: 9.8) ⚙️ Błąd w mechanizmie resetu hasła umożliwia przejęcia konta dowolnego użytkownika – w tym administratora. 🥷 Warunkiem koniecznym do przeprowadzenia ataku jest znajomość nazwy użytkownika. ⚠️ Podatne wersje: 6.0.0 - 6.0.6. ✅ W wersji 6.0.7 (i nowszych) błąd został naprawiony. Zalecamy aktualizację. 🔗 https://sekurak.pl/blad-w-popularnej-wtyczce-do-wordpressa-pozwala-na-przejecie-konta-administratora-cve-2026-8206-kirki/

    Post summary

    A critical CVE‑2026‑8206 flaw in Kirki allows accounts to be hijacked via the password reset feature; the issue is fixed in versions 6.0.7 and later.

    0303164.0K
    44.4K followersView on X
  • elhacker.NET@elhackernet
    Disclosure

    Vulnerabilidad en plugin de WordPress Kirki expone a más de 500.000 webs a escalada de privilegios Se ha detectado una vulnerabilidad crítica en el plugin de WordPress Kirki (versiones 6.0.0 a 6.0.6), identificada como CVE-2026-8206 https://blog.elhacker.net/2026/06/vulnerabilidad-en-plugin-de-wordpress.html

    Post summary

    El texto anuncia la detección de una vulnerabilidad crítica en el plugin WordPress Kirki, identificada como CVE-2026-8206, sin detallar PoC ni pasos de explotación.

    0601531.7K
    140.9K followersView on X
  • モーくん🐮｜WordPress × セキュリティ@accell_mo_kun
    Active Exploitation

    おはモー🐮 【WP三連発】昨日から大物が続けて来てるモー🐮 🔴 Kirki プラグイン CVE-2026-8206（CVSS 9.8）50万サイト影響、修正後も15万サイト脆弱 🔴 WP Maps Pro CVE-2026-8732 実悪用確認継続 🔴 WP約2,000件がSteamプロフィールC&C経由でマルウェア感染 水曜の朝、保守クライアントの全プラグイン棚卸し1時間モー🐮 #おは戦80603js🌊 #WordPressセキュリティ

    Post summary

    The post reports several WordPress plugin vulnerabilities, highlighting that CVE‑2026‑8732 is actively exploited in the wild and noting substantial site impact and incomplete patch coverage.

    1003094
    870 followersView on X
  • PurpleOps@PurpleOps_io
    Disclosure

    Another password-reset flow that trusts the wrong email. CVE-2026-8206 in the Kirki WordPress plugin (9.8 CVSS) lets an unauthenticated attacker reset an admin's password by supplying their own address to the forgot-password endpoint. ~150K sites exposed. Same root cause we just saw in Meta's AI recovery flow. Patch to 6.0.7+.

    Post summary

    CVE‑2026‑8206 is a password‑reset flaw in the Kirki WordPress plugin that lets unauthenticated users re‑set admin passwords, affecting roughly 150,000 sites; applying patch 6.0.7+ removes the threat.

    21001162
    585 followersView on X
  • DFIR Radar@DFIR_Radar
    Patch

    CVE-2026-8206 (CVSS 9.8) in Kirki WordPress plugin allows unauthenticated attackers to hijack admin accounts by sending password reset links to attacker-controlled emails. 150,000 sites affected. Update to version 6.0.7 immediately. #DFIR_Radar https://t.co/zHAACF4Glx

    Post summary

    A new high‑severity CVE (CVE‑2026‑8206) in the Kirki WordPress plugin is disclosed, allowing unauthenticated attackers to hijack admin accounts via password reset links; users are urged to immediately upgrade to version 6.0.7.

    11011165
    1.8K followersView on X
  • Directoratul Național de Securitate Cibernetică@DNSC_RO
    Disclosure

    🚨 ALERTĂ - Vulnerabilitate critică la nivelul plugin-ului WordPress Kirki ⚠️ CVE-2026-8206 este o vulnerabilitate critică, cu scor CVSS de 9.8, de tip “Privilege Escalation to Account Takeover”. 👉 Citiți alerta: https://www.dnsc.ro/citeste/alerta-vulnerabilitate-critica-la-nivelul-plugin-ului-wordpress-kirki #DNSC #Alert #CyberSecurity https://t.co/5HdmnrJ8lF

    Post summary

    The alert announces a new, critical vulnerability (CVE-2026-8206) in the WordPress Kirki plugin, detailing its high CVSS score and privilege escalation impact, but does not mention any PoC, exploit, patch, or active exploitation.

    02010133
    4.7K followersView on X
  • Elusive@ElusivePrivacy
    Active Exploitation

    Kirki WordPress Plugin Account Takeover (CVE-2026-8206) CVE-2026-8206. CVSS 9+. Unauthenticated password reset to attacker-controlled email complete admin account takeover on WordPress sites running Kirki plugin v6.0.0–6.0.6. Actively exploited in the wild. Source: BleepingComputer Full analysis → http://t.me/VulnerabilityNews Follow @VulnerabilityNw

    Post summary

    CVE‑2026‑8206 is a high‑severity vulnerability causing unauthenticated password resets to attacker‑controlled emails, enabling full admin takeover on affected Kirki plugin versions, and it is currently being exploited in the wild.

    1101082
    185 followersView on X
  • Xavier Rivera@XavierRiveraX
    Active Exploitation

    CVE-2026-8206 in the WordPress Kirki plugin is under active exploitation. Any authenticated user can escalate to admin and take over affected sites. If you're running Kirki, patch or deactivate immediately.

    Post summary

    CVE-2026-8206 grants authenticated users admin privileges and is actively exploited; users of WordPress Kirki should immediately patch or deactivate the plugin.

    02010144
    562 followersView on X
  • Falcon Internet@falconinet
    Disclosure

    Kirki CVE-2026-8206: Anyone Can Take Admin on Half a Million WordPress Sites https://www.falconinternet.net/blog/kirki-cve-2026-8206-wordpress-admin-takeover?ref=x #Security #WordPress https://t.co/S5vRgXPKf1

    Post summary

    The tweet announces a new WordPress vulnerability (CVE-2026-8206) and directs readers to a blog post for details, but provides no evidence of PoC, exploitation, or mitigation.

    0002047
    20 followersView on X
  • SoEmailSecurity@Soemailsecurity
    General

    Kirki plugin vulnerability CVE-2026-8206 lets hackers take over WordPress admin accounts, what's the real cost of using free plugins? Check your email security too with a free scan at http://soemailsecurity.com, can you afford to wait? #WordPressSecurity #EmailSecurity

    Post summary

    The post mentions CVE‑2026‑8206 claiming it enables admin takeover, but offers no concrete technical details, evidence of exploitation, or remediation information—essentially a vague security warning.

    1001039
    60 followersView on X
  • Orizon@OrizonCyber
    Patch

    🚨 CVE-2026-8206 — CVSS 9.8/10 ██████████ The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/Lu2MgVI6p6

    Post summary

    The tweet identifies a critical vulnerability in the Kirki WordPress plugin (CVE-2026-8206) and urges users to apply a patch.

    10010170
    48 followersView on X
  • Stanislav Klevtsov@stansecure
    Patch

    Top #CVE to patch 👀 * #Ivanti Sentry unauth #RCE (CVE-2026-10520 * #CheckPoint VPN auth bypass (CVE-2026-50751) * @Oracle PeopleSoft missing auth (CVE-2026-35273) * @Microsoft Exchange Server (CVE-2026-42897) * @Microsoft June #PatchTuesday — 200+ CVEs, 38 critical. * @Google #Android #PrivEsc (CVE-2025-48595) * @drupal #SQLi (CVE-2026-9082) * @WordPress Kirki PrivEsc (CVE-2026-8206) * @Splunk Enterprise unauth file creation (CVE-2026-20253)

    Post summary

    The tweet lists several high‑severity CVEs and stresses the importance of applying vendor patches, notably Microsoft’s upcoming Patch Tuesday.

    10000177
    43 followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-8206 - Critical Privilege Escalation in Kirki WordPress plugin (v6.0.0-6.0.6). Unauthenticated account takeover via password reset email manipulation. CVSS 9.8. No patch available—disable immediately. #CVE #WordPress #infosec #DevSecOps FREE FIX: https://www.valtersit.com/cve/CVE-2026-8206/

    Post summary

    A critical privilege‑escalation vulnerability (CVSS 9.8) exists in Kirki WordPress plugin versions 6.0.0‑6.0.6; no official patch is available, so disabling the plugin or using the provided free fix is recommended.

    1000050
    919 followersView on X
  • eatransform.net@Eatransform_net
    General

    WordPressプラグインKirkiに重大な脆弱性・50万サイトが管理者乗っ取りのリスク【CVE-2026-8206】 #WordPress #セキュリティ #脆弱性 #WordPressプラグイン #サイバーセキュリティ #Kirki https://eatransform.net/wordpress-kirki-vulnerability-cve-2026-8206

    Post summary

    A tweet announces a serious vulnerability (CVE-2026-8206) affecting the WordPress Kirki plugin, highlighting potential admin takeover risks for up to 500,000 sites.

    0010080
    27 followersView on X
  • モーくん🐮｜WordPress × セキュリティ@accell_mo_kun
    General

    おはモー🐮 【木曜朝のCVE警戒5発】6月初週、大型脆弱性が連発モー🐮 🔴 Kirki CVE-2026-8206（CVSS 9.8、15万サイト） 🔴 Burst Statistics CVE-2026-8181（20万インストール） 🔴 Redis RCE CVE-2026-23479（2年潜伏のUse-After-Free） 🔴 IBM WebSphere CVE-2026-9319 🔴 M365 Android FlagLeft（トークン窃取） WP保守＋バックエンド連携の人は週次棚卸しタイミングだモー🐮 #おは戦80604jm🌴 #WordPressセキュリティ

    Post summary

    A short alert listing five new CVEs with impact metrics and brief descriptions, without additional technical, exploit, or mitigation information.

    0001074
    767 followersView on X
  • IntegSec@integ_sec
    General

    CVE-2026-8206: Kirki WordPress Plugin Account Takeover Vulnerability - What It Means for Your Business and How to Respond https://hubs.li/Q04m8Y3g0

    Post summary

    The article announces CVE-2026-8206, highlighting a potential account takeover risk in the Kirki WordPress plugin, but does not provide exploit details, patch information, or evidence of active exploitation.

    0000035
    31 followersView on X
  • Atomic Edge@atomicedgeWAF
    PoC

    https://atomicedge.io/cve-proof/cve-2026-8206-kirki-version-6-0-6-critical-vulnerability-proof-of-concept CVE-2026-8206 kirki (CVSS Score 9.8) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge #cybersecurity …

    Post summary

    The post announces a Proof of Concept for CVE-2026-8206 affecting the Kirki WordPress plugin, highlighting the vulnerability but not indicating active exploitation or fixes.

    0000026
    9 followersView on X
  • iototsecnews@iototsecnews
    Disclosure

    Kirki WordPress プラグインの脆弱性 CVE-2026-8206 が FIX：Web サイト乗っ取りの恐れ https://iototsecnews.jp/2026/06/03/wordpress-plugin-vulnerability-exposes-500000-websites-to-privilege-escalation-attacks/ Kirki プラグインの脆弱性 CVE-2026-8206 は、 パスワード・リセット時に入力されたユーザー名とメールアドレスの関連性を、システム側で正しく検証していなかったロジックの欠陥が原因です。有効なユーザー名さえ一致すれば、リクエストに記載された攻撃者側のメールアドレスへと、リセット用のトークンが送信されてしまうという問題です。ご利用のチームは、ご注意ください。 #CVE20268206 #Kirki #Vulnerability #WordPress

    Post summary

    The post announces a new vulnerability in the Kirki WordPress plugin (CVE‑2026‑8206), detailing how a missing validation allows attackers to hijack password reset tokens. No PoC, exploit code, or patch is provided.

    00000103
    497 followersView on X
  • Marcus Lenngren@lenngrenm
    Active Exploitation

    ⚠️ CRITICAL: Critical Kirki flaw exploited to hijack WordPress admin accounts Critical privilege escalation flaw in Kirki WordPress plugin (CVE-2026-8206) allows unauthenticated attackers to reset any user account including admins via an unvalidated REST API https://…

    Post summary

    A critical privilege‑escalation flaw (CVE-2026-8206) in the Kirki WordPress plugin is actively exploited, enabling attackers to reset admin accounts through an unvalidated REST API; no patch or PoC is provided in the text.

    0000040
    323 followersView on X
  • Commonwealth Sentinel@CwealthSentinel
    Active Exploitation

    Hackers are exploiting a critical privilege escalation vulnerability (CVE-2026-8206) in the Kirki plugin for WordPress to take over any user account, including those belonging to administrators. https://ift.tt/wpumzRj https://t.co/wgWkvI21Qp

    Post summary

    The post reports that hackers are actively exploiting CVE-2026-8206 in the Kirki plugin to gain administrator access on WordPress sites.

    0000050
    1.9K followersView on X

Explore more

Back to dashboard