Hackers are actively exploiting a critical privilege escalation vulnerability in the Kirki plugin for WordPress, tracked as CVE-2026-8206. The flaw affects Kirki versions 6.0.0 through 6.0.6 and allows unauthenticated attackers to take over user accounts, including administrator accounts, by abusing the plugin’s password reset process. WordPress security, once again, proves that plugins are both useful tools and tiny chaos engines with update buttons. 

Why This Matters 

Kirki is widely used for WordPress customization and page-building features. Wordfence reported that Kirki has more than 500,000 active installations, though the vulnerable 6.0 branch is estimated to affect around 150,000 sites. That still gives attackers a large enough target pool to make exploitation worthwhile, because criminals also enjoy scale, sadly.

The vulnerability exists because the plugin accepts an arbitrary email address during the password reset flow when a username is supplied. This allows an unauthenticated attacker to trigger a valid password reset link for a target user and send that reset link to an attacker-controlled email address. If the targeted user is an administrator, the attacker can gain full admin access to the WordPress site. ([Tenable®][3]) 

What Attackers Can Do 

Once attackers gain admin access to a WordPress site, they can install malicious plugins, create backdoor accounts, modify themes, inject JavaScript, redirect visitors to phishing or malware pages, steal customer data, or use the site as part of a larger attack campaign. A compromised WordPress admin account is not a minor issue. It is the website equivalent of handing over the keys and hoping the burglar respects the interior design.

This type of flaw is especially dangerous because it does not require valid login credentials. Attackers can target exposed vulnerable sites remotely and attempt account takeover through the vulnerable password reset mechanism.

What Website Owners Should Do 

Website owners using Kirki should immediately update to version 6.0.7 or later. Security teams should also audit WordPress administrator accounts, review recent password reset activity, check for unknown users, inspect newly installed plugins and themes, and scan for suspicious files or web shells. Orca Security also recommends reviewing user registries, checking for unauthorized privilege changes, and monitoring for malicious REST API activity targeting password reset endpoints. 

Administrators should also revoke suspicious sessions, reset admin passwords, enable multi-factor authentication, restrict admin access by IP where practical, and ensure backups are available and clean. Plugin updates should not be treated as casual housekeeping. In WordPress environments, they are often the difference between a functioning website and a malware distribution kiosk.

Final Comment 

The Kirki vulnerability is another reminder that WordPress security depends heavily on plugin security. A single vulnerable plugin can expose the entire website, even when WordPress core itself is fully updated.

The key lesson is simple: update Kirki immediately, audit administrator accounts, check for signs of compromise, and monitor password reset activity. Website owners must stop treating plugins as harmless add-ons. Every plugin expands the attack surface, and when that plugin handles authentication or account recovery, any weakness can quickly become full site takeover. 

Hackers are exploiting a critical privilege escalation vulnerability (CVE-2026-8206) in the Kirki plugin for WordPress to take over any user account, including those belonging to administrators. [...]

Source: Critical Kirki flaw exploited to hijack WordPress admin accounts via Bleeping Computer — published 02 Jun 2026.