Critical WordPress Plugin Bug Exposes 500K+ Sites to Privilege Escalation

Key Takeaways

• A critical vulnerability, CVE-2026-8206, has been identified in the Kirki WordPress plugin, affecting versions 6.0.0 through 6.0.6.
• This flaw enables unauthenticated attackers to escalate privileges and potentially take over administrator accounts on over 500,000 WordPress sites.
• The vulnerability exploits a flawed password reset mechanism, allowing attackers to direct reset tokens to their own email addresses.
• A patch is available in Kirki version 6.0.7, and immediate updates are strongly recommended for all affected users.

A severe security vulnerability within the widely adopted Kirki WordPress plugin has left more than half a million websites exposed to potential account compromise. Security researchers have highlighted that approximately 150,000 of these sites are currently operating vulnerable versions of the plugin, making them immediate targets for exploitation.

Designated as CVE-2026-8206 and boasting a critical CVSS score of 9.8, this flaw impacts Kirki plugin iterations from 6.0.0 up to and including 6.0.6.

The core of the issue lies in a defective password reset function, which attackers can manipulate without authentication to elevate their privileges, potentially leading to full administrative control of affected websites.

Security researcher Choigyeongmin is credited with discovering this vulnerability, reporting it via the Wordfence Bug Bounty Program, and receiving a reward of $6,436 for the disclosure.

Wordfence confirmed the vulnerability on May 8, 2026, and promptly rolled out firewall protections for its premium subscribers on May 9, preceding the public announcement of the flaw.

WordPress Plugin Vulnerability Exposes Websites

Kirki, a popular plugin known for enhancing WordPress customizer capabilities and streamlining page building, exposes a REST API endpoint that manages password reset requests.

The vulnerability specifically resides within the handle_forgot_password() function, where the plugin erroneously trusts user-provided input during the password reset sequence.

In a secure design, a password reset request should exclusively send a reset link to the email address officially linked with the user account in question.

However, the compromised Kirki versions accept both a username and an email address in the reset request without adequately verifying the legitimate association between them.

When a valid username is submitted, the plugin correctly identifies the corresponding user account. Nevertheless, it proceeds to utilize the email address supplied by the attacker in the request, rather than the legitimate one registered to the user.

This logical flaw facilitates a straightforward exploitation path. An attacker can initiate a password reset request, providing a genuine username (such as an administrator’s) along with an arbitrary email address under their control.

The plugin then generates a valid reset token and dispatches it to the attacker’s specified email, bypassing the legitimate user’s inbox entirely.

With this reset link, the attacker can establish a new password for the account, thereby gaining unauthorized access. Successful exploitation can result in a complete compromise of the website.

Post-exploitation, attackers may engage in activities such as installing malicious plugins, injecting backdoors, creating unauthorized administrator accounts, or deploying persistent webshells, aligning with common privilege escalation and persistence tactics.

Wordfence communicated the flaw to Themeum on May 15, 2026, and a corrective patch was released in version 6.0.7 just three days later.

Mitigation efforts are direct but urgent. Website administrators are strongly advised to update the Kirki plugin to version 6.0.7 or a newer release without delay.

Additional layers of protection are offered through Wordfence firewall rules; premium users already benefit from this coverage, with free users scheduled to receive it on June 8, 2026.

Considering the ease of exploitation and the severe potential impact, this vulnerability poses a substantial risk to WordPress environments, particularly those with publicly exposed user enumeration or accessible login functionalities. Prompt patching and vigilant monitoring for suspicious password reset activities are crucial to preventing compromise.

What You Should Do

• Immediately update the Kirki WordPress plugin to version 6.0.7 or higher.
• If you are a Wordfence user, ensure your firewall rules are up to date, especially if you are a premium subscriber, as you already have protection. Free users should ensure their firewall is active for the June 8, 2026 update.
• Monitor your website’s logs for any unusual password reset requests or unauthorized account activity.
• Implement strong, unique passwords for all administrator accounts and consider enabling multi-factor authentication (MFA) where available.
• Regularly back up your WordPress site to facilitate quick recovery in case of compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.