CVE-2026-8206 — Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.7

CVE	Vulnerability	Type	Severity	Affected	Fixed in	Published	Status
CVE-2026-8206	Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.7	Improper Privilege Management	Critical 9.8	< 6.0.7	6.0.7	2026-06-01	—

CVE-2026-8206

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.

Source: CVE.org

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)