CVE-2026-8206

Published Jun 2, 2026

Last updated 11 hours ago

CVSS critical 9.8
SMTP

Overview

Description
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.
Source
security@wordfence.com
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

security@wordfence.com
CWE-269

Social media

Hype score
Not currently trending

  1. CVE-2026-8206 - Critical Privilege Escalation in Kirki WordPress plugin (v6.0.0-6.0.6). Unauthenticated account takeover via password reset email manipulation. CVSS 9.8. No patch available—disable immediately. #CVE #WordPress #infosec #DevSecOps FREE FIX: https://t.co/hlakIGAGL

    @HugoValters

    7 Jun 2026

    43 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  2. おはモー🐮 【木曜朝のCVE警戒5発】6月初週、大型脆弱性が連発モー🐮 🔴 Kirki CVE-2026-8206（CVSS 9.8、15万サイト） 🔴 Burst Statistics CVE-2026-8181（20万インストール） 🔴 Redis RCE CVE-2026-23479（2年潜伏のUse-After-Free

    @accell_mo_kun

    3 Jun 2026

    55 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in takeover of Oracle Workflow. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).•CVE-2026-62547
  2. System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data.•CVE-2026-50205
  3. An issue in Nodemailer smtp_server before v.3.18.3 allows a remote attacker to cause a denial of service via the SMTPStream._write, lib/smtp-stream.js components•CVE-2026-38728
  4. Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.•CVE-2026-45185
  5. Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib.SMTP.starttls()` without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent during the subsequent `login()` call. Users are advised to upgrade to the `apache-airflow-providers-smtp` version that contains the fix.•CVE-2026-41016

References

Sources include official advisories and independent security research.