CVE-2026-8206

This repository contains a functional PoC for CVE-2026-8206, an unauthenticated account takeover vulnerability in the Kirki Customizer Framework WordPress plugin (versions 6.0.0-6.0.6). The exploit hijacks password reset emails by sending a crafted POST request to a vulnerable REST endpoint, allowing attackers to specify their own email for receiving the reset link.

This exploit targets CVE-2026-8206, an unauthenticated account takeover vulnerability in the Kirki WordPress plugin. The exploit abuses the CompLibFormHandler REST API endpoint to redirect password reset emails to an attacker-controlled address by manipulating the 'email' parameter in the forgot-password request.

This PoC exploits CVE-2026-8206, an unauthenticated account takeover vulnerability in the Kirki WordPress plugin. The exploit targets the CompLibFormHandler REST API endpoint to redirect password reset emails to an attacker-controlled address by manipulating the 'emailBody' parameter with a crafted JSON payload containing a reset link chip.

This repository contains a functional Python exploit for CVE-2026-8206, targeting an unauthenticated account takeover vulnerability in the Kirki Plugin via the CompLibFormHandler REST API endpoint. The exploit automates user enumeration, nonce extraction, and password reset email redirection to an attacker-controlled address.

This repository contains a functional exploit PoC for CVE-2026-8206, demonstrating a password reset vulnerability in the Kirki WordPress plugin. The PoC includes a Docker-based lab environment to test both vulnerable (6.0.6) and patched (6.0.7) versions, with scripts to automate the exploitation and verification process.

This repository contains a functional exploit for CVE-2026-8206, targeting the Kirki WordPress plugin (versions ≤ 6.0.6). The exploit automates the detection of vulnerable installations, extracts nonces, and sends crafted requests to hijack password reset links, allowing unauthenticated attackers to take over user accounts.

This Python script automates the exploitation of CVE-2026-8206 in Kirki (versions 6.0.0-6.0.6) by abusing the password reset functionality to send a reset link to an attacker-controlled email. It extracts a nonce from the target site and crafts a malicious request to trigger the vulnerability.