Critical Kirki flaw exploited to hijack WordPress admin accounts
Hackers are exploiting a critical Kirki plugin flaw to take over WordPress accounts, including admins. Wordfence blocked more than 222 attack attempts in 24 hours.
Intelligence analysis by GPT-5.4 Mini
A critical privilege-escalation bug in the WordPress Kirki plugin is being actively abused to generate password-reset links for arbitrary accounts. Because the flaw can let attackers hijack administrator logins, Wordfence says site owners should update to the fixed release immediately or disable the plugin.
A broken door in a popular website plugin is letting burglars make fake reset requests and steal the keys to admin accounts. It is like asking the front desk to hand over a spare key to the wrong person, then that person can walk into the whole building.
Analysis
What happened
Wordfence says attackers are exploiting CVE-2026-8206, a critical privilege-escalation flaw in the Kirki plugin for WordPress. The plugin, called Kirki - Freeform Page Builder, Website Builder & Customizer, is active on more than 500,000 websites.
How the bug works
According to the article, the vulnerability sits in a custom REST API password-reset path exposed through handle_forgot_password(). The flaw allows the plugin to accept an arbitrary email address during reset requests. If an attacker supplies a username, the plugin creates a valid reset link for that account, but sends it to the attacker-controlled email address instead of the account holder’s registered address. That makes account takeover possible without authentication.
Scope and exploitation
Wordfence says its firewall blocked more than 222 attempts against customers in the past 24 hours, which shows the bug is already being used in the wild. The issue was introduced in version 6.0.0 and affects versions through 6.0.6. The article notes that those versions account for nearly 40% of the plugin’s user base, based on WordPress.org download statistics.
Response timeline
Security researcher CHOIGYENGMIN reported the issue to Wordfence on May 4, 2026. Wordfence notified the vendor on May 16, and a fix was released in version 6.0.7 on May 18, 2026. The article’s guidance is straightforward: upgrade to 6.0.7 or disable the plugin.
Why this is serious
If an attacker reaches admin-level access, the article says they could install malicious plugins, change site content, deploy web shells or persistent backdoors, and access private databases. The low barrier to entry and active exploitation make this a high-risk WordPress security issue.
Key points
- Wordfence says CVE-2026-8206 in Kirki is being actively exploited against WordPress sites.
- The flaw can let unauthenticated attackers trigger password resets for arbitrary user accounts, including admins.
- Wordfence blocked more than 222 exploit attempts in the last 24 hours.
- The issue affects Kirki versions 6.0.0 through 6.0.6 and was fixed in 6.0.7.
- The article urges site owners to upgrade immediately or disable the plugin.
The vendor has already released version 6.0.7, so affected sites have a clear fix path. If administrators patch quickly or disable the plugin, they can cut off a live attack path that Wordfence says is already being used.
Sites that stay on versions 6.0.0 through 6.0.6 remain exposed to unauthenticated account takeover. If attackers gain admin access before patching happens, they may be able to modify the site, add backdoors, or reach sensitive data.
