Jenderal92/CVE-2026-8206

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python 2.7 script that exploits CVE-2026-8206 in the Kirki WordPress plugin (≤ 6.0.6) by sending a crafted POST request to the unauthenticated REST endpoint `/wp-json/KirkiComponentLibrary/v1/kirki-forgot-password` with an arbitrary attacker-controlled email address, causing the password reset link to be sent to the attacker.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward exploit for CVE-2026-8206. It sends crafted password-reset requests to a vulnerable WordPress REST endpoint using attacker-supplied email and harvested nonces. No concealed backdoor, unrelated payload, or operator-directed harm is present. The code performs only the advertised exploit behavior.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareKirki WordPress plugin
Attack typesprivilege escalationaccount takeover
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a crafted POST request to the vulnerable endpoint to trigger the password reset email being sent to the attacker's address, which constitutes exploitation, not mere detection.

CVE-2026-8206.py:149-173README.md:6

Requirements

  • Target must run a vulnerable version of the Kirki plugin (≤ 6.0.6).CVE-2026-8206.py:59
  • A valid WordPress username must be known or enumerable.CVE-2026-8206.py:175-184
  • A valid WordPress nonce must be extractable from the target site.CVE-2026-8206.py:83-115

Observed behavior

  • Detects the Kirki plugin version by reading readme.txt and kirki.min.css.CVE-2026-8206.py:49-81
  • Enumerates usernames via the WordPress REST API or falls back to 'admin'.CVE-2026-8206.py:175-184
  • Harvests nonces from multiple common WordPress paths using regex patterns.CVE-2026-8206.py:83-147
  • Sends a POST request to the vulnerable endpoint with the target username, attacker email, and harvested nonce.CVE-2026-8206.py:149-173
  • Writes successfully exploited targets to res.txt.CVE-2026-8206.py:223-224
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Attacker Email
attacker@example.comHardcoded placeholder email used in exploit payload; user is instructed to replace it with their own.CVE-2026-8206.py:13
Exploit Endpoint
/wp-json/KirkiComponentLibrary/v1/kirki-forgot-passwordThe vulnerable REST endpoint targeted by the exploit.CVE-2026-8206.py:160
Output File
res.txtFile where successful exploit results are logged; contains target URL, username, and attacker email.CVE-2026-8206.py:223-224
Review boundaries

What the analysis did not establish

  • Evidence is limited to the supplied source code and README; no runtime behavior or network traffic was observed.
  • The script is written for Python 2.7, which may affect execution in modern environments.
  • Only the two text files (CVE-2026-8206.py and README.md) were reviewed; no binary or other files were present in the evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1