Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
Title source: cnaExploitation Summary
CVE-2026-8206 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 3 public exploits from researchers including rootdirective-sec, Jenderal92, O99099O.
AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2026-8206, demonstrating a password reset vulnerability in the Kirki WordPress plugin. The PoC includes a Docker-based lab environment to test both vulnerable (6.0.6) and patched (6.0.7) versions, with scripts to automate the exploitation and verification process.
Description
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.
Exploits (3)
This repository contains a functional exploit PoC for CVE-2026-8206, demonstrating a password reset vulnerability in the Kirki WordPress plugin. The PoC includes a Docker-based lab environment to test both vulnerable (6.0.6) and patched (6.0.7) versions, with scripts to automate the exploitation and verification process.
This repository contains a functional exploit for CVE-2026-8206, targeting the Kirki WordPress plugin (versions ≤ 6.0.6). The exploit automates the detection of vulnerable installations, extracts nonces, and sends crafted requests to hijack password reset links, allowing unauthenticated attackers to take over user accounts.
This Python script automates the exploitation of CVE-2026-8206 in Kirki (versions 6.0.0-6.0.6) by abusing the password reset functionality to send a reset link to an attacker-controlled email. It extracts a nonce from the target site and crafts a malicious request to trigger the vulnerability.
References (8)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H