CVE-2026-8206: Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'

Synopsis

An authentication bypass leading to privilege escalation affects the Kirki Freeform Page Builder, Website Builder and Customizer plugin for WordPress versions 6.0.0 through 6.0.6. The vulnerability is reachable over the network with no credentials required: the plugin's password-reset handler accepts an arbitrary attacker-controlled email address alongside a valid username, so the reset link is delivered to the attacker rather than the legitimate account owner. Successful exploitation gives the attacker full control of any registered user account, including administrator accounts, enabling complete site takeover with read, write, and availability impact. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable password-reset endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationNot required

  No account or credentials of any kind are needed; the attack targets the unauthenticated password-reset flow.

• Victim interactionNot required

  The attacker receives the reset link in their own email address and completes the takeover without any action from the victim.

• Attack complexityDetail

  The exploit is reliable and condition-free: no race conditions, memory layout dependencies, or environmental prerequisites are required beyond knowing a registered username.

Blast Radius

• Attacker receives a valid password-reset link for any registered WordPress user, including administrators, and sets a new password of their choosing.
• Full administrative access lets the attacker read all site content, stored user credentials, and private data held in the WordPress database.
• Attacker can install or modify plugins and themes, inject malicious code into pages, or exfiltrate customer and subscriber records.
• Site availability can be disrupted by the attacker deactivating plugins, deleting content, or locking out legitimate administrators.