If you received an email from me pointing you to this page, it is because your website appears to be running a vulnerable version of Kirki – Freeform Page Builder, Website Builder & Customizer (the WordPress plugin kirki, by Themeum). This page explains why that matters and how to fix it.

This notice concerns CVE-2026-8206, a critical, actively exploited flaw (CVSS 9.8) that lets an attacker take over any registered account on your site, including administrator accounts, without logging in. It affects versions 6.0.0 through 6.0.6 and is fixed in 6.0.7 (released 18 May 2026). If you are running an affected version, update Kirki to 6.0.7 or later (the latest 6.1.x release is recommended) as soon as possible. Because this flaw hands an attacker control of accounts and is being exploited in the wild, you should also check for signs of unauthorized access (see If you were on an affected version below).

This is a plugin flaw, not a WordPress core flaw. A fully up-to-date WordPress does not protect you if the Kirki plugin itself is on an affected version.

Is this message legitimate?

Yes. This is a good-faith, responsible-disclosure notice from an independent security researcher. I am not asking you for money, passwords, or access to your site, and I have not attempted to break into it, upload anything, or exploit anything.

All I did was look at publicly visible files that your website serves to every visitor (the same way your homepage is public) and note the version number that the Kirki plugin publishes in its public readme.txt file. I specifically did not touch the vulnerable password-reset feature, and nothing about this check touches your data, your admin area, or any private part of your site.

If you would like to verify who I am, see the contact details at the bottom of this page and the About page.

Why this matters

Kirki is a widely used page-builder and customizer plugin (around 500,000 active installs). Its password-reset handler (a function called handle_forgot_password) contains a mistake: when a reset request supplies a username, the handler also accepts an attacker-supplied email address for the same request. The password-reset link is then sent to that address instead of the account owner’s.

The practical effect is that a remote attacker who simply knows the username of any registered user on your site, administrators included, can have that user’s password-reset link delivered to the attacker’s own inbox, without logging in and without any interaction from the real owner. Following the link lets the attacker set a new password and take full control of the account. For an administrator account, that means full control of the site: creating new admin users, installing a plugin or theme (a common way to plant a back door), changing content, or reading data.

The flaw was scored 9.8 out of 10 (critical severity). Admin-account hijacking through this flaw has been reported in the wild, and a public mass-exploitation tool exists. If my email cited this issue, it means the version your site reports falls within the affected range. I did not test whether your particular site is exploitable or already compromised, only that it reports an affected version.

The good news: updating to the fixed version closes the hole, and the update is straightforward.

How to check your version

You do not have to take my word for which version you are running.

From the public manifest (no login needed): open yourdomain.com/wp-content/plugins/kirki/readme.txt in a browser. The Stable tag: line near the top is the version your Kirki install reports, and this is the same public file I read.

From the WordPress admin area (if you have access):

  1. Log in to your WordPress dashboard (usually at yourdomain.com/wp-admin).
  2. Go to Plugins then Installed Plugins.
  3. Find Kirki and note the version shown beneath its name.

Then apply this rule, and note that versions compare numerically, not alphabetically:

  • 6.0.0 through 6.0.6: affected, update now.
  • 6.0.7 or newer, including 6.0.10, 6.0.13, 6.0.14, and all 6.1.x releases: already fixed. Do not be misled by the text ordering; 6.0.10 is a later (fixed) release than 6.0.7, because 10 is greater than 7.
  • 3.0.x or 3.1.x: this is a different product with the same kirki slug (Aristath’s Kirki Customizer Framework, which Themeum’s 6.x page builder later replaced). The old framework is not affected by this issue, and this notice does not apply to it.

How to upgrade

The safest path is to update through WordPress itself, and to back up first:

  1. Back up your site (files and database) before making changes. Most hosting providers offer one-click backups, or use a WordPress backup plugin.
  2. In the WordPress admin, go to Dashboard then Updates, or Plugins then Installed Plugins. If a Kirki update is listed, install it from here.
  3. If you prefer the command line, WP-CLI does the same thing: wp plugin update kirki.
  4. If no update appears, you can get the latest release directly from the plugin’s page on the WordPress.org directory, Kirki, and update via Plugins then Add New Plugin then Upload Plugin.
  5. After updating, confirm the new version number (6.0.7 or later; the latest 6.1.x is recommended) using the steps above, and check that your site loads normally.

While you are in there, it is worth confirming that WordPress core and your other plugins are up to date, since the same principle applies to all of them.

If you were on an affected version

Because this flaw is being actively exploited to take over accounts, a site that ran an affected version should not assume that simply updating is enough. The update removes the vulnerability, but it does not undo any access an attacker may already have gained. You (or your webmaster) should check for that on your own site:

  • Review your administrator accounts. In Users then All Users, filter by Administrator and remove any account you do not recognize. Attackers commonly add a new admin user to keep access.
  • Review recent password resets. A reset you or your users did not request, or an account whose password suddenly stopped working, is a red flag for this particular flaw. If in doubt, reset the passwords of administrator accounts yourself.
  • Review recently installed or modified plugins and themes. Look for anything you did not install yourself, and for plugins with generic or unfamiliar names, a rogue plugin or theme is a common way to plant a back door.
  • Review application passwords. For each user (Users then the user’s Profile), check the Application Passwords section and revoke any entry you did not create.
  • Watch for other signs. Unexpected new content or pages, changes to admin email or site URL settings, or unfamiliar scheduled tasks are worth investigating.

If you find evidence of unauthorized access, treat the site as compromised: remove any rogue users, plugins, or themes, rotate your credentials (WordPress admin, database, and hosting panel), and consider restoring from a known-good backup taken before the intrusion. If your organization has an IT security team, loop them in.

I want to be clear: I have not checked your site for any of these indicators, and I do not know whether your site was affected. This list is here so you can check for yourself. A site in the affected version range may also already be protected by other means (a web application firewall, or a hosting-level backport); this notice is a version-based observation, not a statement that your site was exploitable at the time I checked.

I do not have a webmaster / I am stuck

If you are not the person who maintains the site, please forward this page to whoever does (your web developer, agency, or hosting provider). They will recognize the steps above quickly.

If you are maintaining the site yourself and get stuck, I am happy to help point you in the right direction at no cost. Reach out using the contact details below.

Contact

Evan Harris, Security Researcher

I reach out about issues like this purely to help operators secure their sites. If you would prefer not to be contacted again, just let me know and I will honor that.

References

Official advisories and tracking

Vendor / plugin