A critical security flaw in the Kirki customizer framework plugin has been patched after researchers discovered it could allow anyone — without logging in — to take over any account on an affected WordPress site, including administrator accounts. The vulnerability affects an estimated 150,000 sites running Kirki versions 6.0.0 through 6.0.6 — out of more than 500,000 active installations — introduced with the plugin’s major 6.0 release.
The flaw carries a CVSS score of 9.8 (Critical) and is tracked as CVE-2026-8206. It was discovered by researcher CHOIGYEONGMIN, who reported it responsibly through the Wordfence Bug Bounty Program and received a $6,436 bounty commensurate with the flaw’s severity and the plugin’s install base. The patched version, Kirki 6.0.7, was released on May 18, 2026 — two days after Themeum, the company behind Kirki, acknowledged the report.
The vulnerability originates in the plugin’s password reset workflow. Kirki exposes a REST API endpoint (a web-accessible interface that handles requests between services) that processes forgotten password requests. The handle_forgot_password() function accepts both a username and an email address in the same request — but the logic flaw means it never checks whether the supplied email address actually belongs to the account identified by the username.
“This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request, making it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.”
In practice, an attacker only needs to know a target’s WordPress username — often publicly visible on author pages or in post bylines — and supply their own email address alongside it. The plugin generates a valid password reset link and sends it directly to the attacker, who can then set a new password and gain full control of the account. No login or prior access required.
On sites where an attacker targets an administrator account, the result is full site control: installation of malicious plugins, creation of additional admin users, modification of site content, and deployment of persistent backdoors.
Wordfence Premium, Care, and Response subscribers received a firewall rule blocking exploitation attempts on May 9, 2026. Sites on the free Wordfence plan will gain that same protection on June 8, 2026 — meaning unpatched free-tier sites remain exposed to exploit attempts until then. Updating to Kirki 6.0.7 is the only reliable fix regardless of which security tools a site runs.
