# CVE-2026-8206: Kirki Freeform Page Builder privilege escalation via account takeover

Source: https://junglewise.ai/threats/cve-2026-8206-kirki-freeform-page-builder-privilege-escalation-via-account  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-8206 · Severity: critical · CVSS 9.8 · Published 2026-06-02

The Kirki plugin for WordPress, used for building and customizing websites, contains a critical security flaw that allows unauthorized individuals to take over any user account. By exploiting a weakness in the password reset process, an attacker can redirect reset links to their own email address. This could lead to a complete site takeover if an administrator's account is targeted, resulting in data theft or website defacement.

Technologies: [Kirki Framework Kirki Customizer Framework](https://junglewise.ai/threats/technologies/kirki-customizer-framework). Vendors: [Kirki Framework](https://junglewise.ai/threats/vendors/kirki-framework).

## Quick answers

**Is CVE-2026-8206 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8206 being exploited in the wild.

**How severe is CVE-2026-8206?** Critical severity, with a CVSS score of 9.8, published 2 June 2026.

**Which products and versions are affected?** Kirki Framework Kirki Customizer Framework 6.0.0 - 6.0.6.

**Is there a fix for CVE-2026-8206?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8206 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8206?** Check whether you run Kirki Framework Kirki Customizer Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Kirki plugin for WordPress (versions 6.0.0 to 6.0.6) is vulnerable to an account takeover flaw classified as Improper Privilege Management (CWE-269). The vulnerability exists in the password reset logic within the ComponentLibrary controller, specifically where the plugin accepts an arbitrary email address when a valid username is provided in a reset request. An unauthenticated remote attacker can exploit this by initiating a password reset for a target user (such as an administrator) and specifying an attacker-controlled email address to receive the reset token. This allows the attacker to reset the password and gain full access to the account. A patch has been released in the plugin's changeset 3530843.

## Affected products

- Kirki Kirki – Freeform Page Builder, Website Builder & Customizer 6.0.0 - 6.0.6

## Timeline

- 2026-06-02: disclosed: CVE published by Wordfence and NVD

## References

- [https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.4/ComponentLibrary/controller/CompLibFormHandler.php](https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.4/ComponentLibrary/controller/CompLibFormHandler.php)
- [https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.4/ComponentLibrary/controller/CompLibFormHandler.php](https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.4/ComponentLibrary/controller/CompLibFormHandler.php)
- [https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.4/ComponentLibrary/controller/ElementGenerator.php](https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.4/ComponentLibrary/controller/ElementGenerator.php)
- [https://plugins.trac.wordpress.org/browser/kirki/trunk/ComponentLibrary/controller/CompLibFormHandler.php](https://plugins.trac.wordpress.org/browser/kirki/trunk/ComponentLibrary/controller/CompLibFormHandler.php)
- [https://plugins.trac.wordpress.org/browser/kirki/trunk/ComponentLibrary/controller/CompLibFormHandler.php](https://plugins.trac.wordpress.org/browser/kirki/trunk/ComponentLibrary/controller/CompLibFormHandler.php)
- [https://plugins.trac.wordpress.org/browser/kirki/trunk/ComponentLibrary/controller/ElementGenerator.php](https://plugins.trac.wordpress.org/browser/kirki/trunk/ComponentLibrary/controller/ElementGenerator.php)
- [https://plugins.trac.wordpress.org/changeset/3530843/kirki](https://plugins.trac.wordpress.org/changeset/3530843/kirki)

## Related threats

- [Kirki WordPress plugin SQL injection](https://junglewise.ai/threats/cve-2026-12721-kirki-wordpress-plugin-sql-injection)
- [Kirki WordPress plugin PHP Object Injection](https://junglewise.ai/threats/cve-2026-12720-kirki-wordpress-plugin-php-object-injection)
- [Kirki WordPress plugin SSRF in kirki_get_apis](https://junglewise.ai/threats/cve-2026-13147-kirki-wordpress-plugin-ssrf-in-kirki-get-apis)
- [Kirki WordPress plugin HTML injection in password reset email](https://junglewise.ai/threats/cve-2026-12724-kirki-wordpress-plugin-html-injection-in-password-reset-email)
- [Kirki WordPress Plugin authorization bypass in AJAX forms](https://junglewise.ai/threats/cve-2026-8096-kirki-wordpress-plugin-authorization-bypass-in-ajax-forms)