Security Alert CVE-2026-8206 in Kirki allows attackers to restore passwords and take full control of WordPress

A serious failure in the popular Kirki visual builder - known as "Kirki - Freeform Page Builder, Website Builder & Customizer" - is being actively exploited to kidnap WordPress accounts, including those of administrators. The vulnerability CVE-2026-8206 allows unauthenticated attackers to generate password restoration links for any user and send them to addresses controlled by the attacker, which turns a seemingly harmless vector (a "I forgot my password" form) into a direct door to total site control.

The failure was introduced in the 6.0.x series of the plugin and affects versions up to 6.0.6; according to download statistics, a significant proportion of facilities remain exposed. Detections and blockages in nature are real and continuous: the Wordfence security firm has reported and blocked hundreds of abuse attempts in a few hours. You can consult the technical notice and the chronology in the Wordfence report to understand the scope and response of the supplier: Wordfence: report and patch. To check the distribution of plugin versions on WordPress.org, check the public statistics here: Kirki - statistics on WordPress.org.

Technically, the root of the problem was a custom REST API that accepted an arbitrary mail when processing "forgot password" requests. When the attacker provided a valid user name, the system generated a legitimate re-establishment link for that account but sent it to the mail address the attacker had placed on the request. That makes it trivial for an attacker without credentials to turn any account into his. and, after obtaining permission from the administrator, make actions such as installing malicious plugins, introducing persistent backdoors or removing sensitive data.

If you manage sites with Kirki, act now: the official correction was published in version 6.0.7, so immediately update to that version or, if you can't safely update, deactivate and remove the plugin until you do. In addition to the update, it is essential to review possible commitments: look for new users or changes in administrative accounts, scan the site for unauthorized web shells or plugins, and review mail and access records to detect suspicious REST requests that include "kirki" or password restoration patterns out of the ordinary.

I recommend to force a re-establishment and rotation of credentials for high privilege accounts, change keys and secrets used by integrations (APIs, FTP, databases) and restore from a reliable backup if you find suspicious modifications that you cannot explain. It also implements additional detection and mitigation measures: it activates a web application firewall (WAF), limits who can invoke sensitive REST endpoints and monitors safety alerts. If you need a practical guide to hardening WordPress in general, official documentation is a good starting point: Hardening WordPress - official guide.

Finally, this impact highlights two relevant lessons for managers and developers: first, Custom REST APIs are sensitive territory and have to carefully validate mail shipments and destinations; second, keep plugins up to date and minimize the attack surface (remove non-essential supplements) drastically reduces the risk. If you manage multiple sites, automate version verification and patch deployment and consider centralized monitoring and response solutions to reduce critical failure exposure time such as CVE-2026-8206.