Loading story…
A critical vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin is being actively exploited to take over administrator accounts on vulnerable sites. The flaw, tracked as CVE-2026-8206 and rated CVSS 9.8, affects versions 6.0.0 through 6.0.6 and stems from a password-reset REST API that accepts an attacker-supplied email address even when the target account is identified by username. By submitting a privileged username and an email address they control, an unauthenticated attacker can obtain a valid password reset link, reset the victim’s password, and seize the account. Researchers estimate roughly 150,000 sites may be exposed among more than 500,000 active installations, and Wordfence reported blocking 59 attack attempts in a 24-hour period.
See which actors are running it and whether you're in range.
10 events from the most recent confirmed update back to the earliest known activity.
Wordfence said users on its free tier were scheduled to receive firewall protection for CVE-2026-8206 on 2026-06-08. The rollout follows earlier protection for paid customers.
Security reporting said the Kirki vulnerability was being actively exploited to compromise WordPress websites worldwide. Wordfence reported blocking 59 attack attempts targeting the flaw in a 24-hour period.
Wordfence disclosed a critical unauthenticated privilege escalation vulnerability in the Kirki WordPress plugin, tracked as CVE-2026-8206 and rated CVSS 9.8. The flaw can let unauthenticated attackers take over registered accounts, including administrators, and potentially fully compromise affected sites.
Wordfence said researcher CHOIGYEONGMIN reported the Kirki WordPress plugin vulnerability through its bug bounty program and that the issue was validated in early May 2026. The flaw was later tracked as CVE-2026-8206 and affects Kirki versions 6.0.0 through 6.0.6.
Researchers linked the Funnel Builder incident to a broader WordPress plugin compromise involving malicious code embedded in multiple plugins. The embedded code could enable covert privileged account creation and administrator-level persistence.
Attackers actively exploited the Funnel Builder WordPress plugin vulnerability to inject skimming code into WooCommerce checkout pages and steal payment card and billing data. Sansec reported the payload was disguised as Google Analytics or Google Tag Manager code and communicated with attacker-controlled infrastructure over WebSocket.
FunnelKit released version 3.15.0.3 of the Funnel Builder plugin to address a critical unauthenticated vulnerability that attackers were exploiting to inject malicious JavaScript into WooCommerce checkout pages. The company also acknowledged reports of unauthorized script injection.
On 2026-05-18, the Kirki plugin maintainers patched CVE-2026-8206 in version 6.0.7. The bug allowed attackers to abuse the password reset REST API to send a valid reset link for another user to an attacker-controlled email address.
On 2026-05-15, Wordfence reported CVE-2026-8206 in the Kirki WordPress plugin to Themeum. This vendor notification preceded Themeum's release of the 6.0.7 patch three days later.
On 2026-05-09, Wordfence deployed firewall protection for Premium, Care, and Response customers against CVE-2026-8206 in the Kirki plugin. The protection targeted an unauthenticated privilege escalation issue that could enable administrator account takeover.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcearetiq.ai
Open sourcemalware.news
Open sourcecysecurity.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical unauthenticated privilege-escalation flaw, **CVE-2026-75816** (CVSS 9.8), affects the Frontend Admin by DynamiApps WordPress plugin, distributed under the `acf-frontend-form-element` slug. The vulnerability affects versions through **3.29.12** and stems from missing capability checks and an authorization bypass when non-numeric user or post identifiers are supplied. An unauthenticated attacker can alter arbitrary users’ email addresses, then invoke WordPress’s password-reset process to seize an administrator account and fully compromise the affected site. DynamiApps remediated the issue in version **3.29.13**; administrators should update immediately and review user email changes and password-reset activity. No active exploitation was reported at publication.
Sep 6, 2026
A critical vulnerability in the *Post SMTP* WordPress plugin, tracked as CVE-2025-11833, has exposed over 400,000 WordPress sites to potential account and website takeover. The flaw, present in all plugin versions up to and including 3.6.0, stems from missing capability checks in the `__construct` function, allowing unauthenticated attackers to reset passwords for any user, including administrators. Wordfence, which received the initial bug report via its bounty program, has already blocked more than 4,500 attack attempts, and exploitation activity has accelerated since early November. Security researchers warn that at least 210,000 sites remain at risk, with attackers leveraging the vulnerability to access password reset messages and hijack admin accounts. Website owners are strongly advised to update to the patched version released on October 29 or disable the plugin to prevent compromise. The incident follows a previous security issue (CVE-2025-24000) affecting the same plugin, highlighting ongoing risks for sites relying on outdated or unpatched WordPress extensions.
Jun 29, 2026
A critical authentication bypass vulnerability, tracked as **`CVE-2026-15826`**, affects the WordPress plugin **User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor** in versions up to and including **`3.16.4`**. The flaw carries a **CVSS 9.8** rating and stems from a type confusion bug in the plugin’s autologin flow: a `WP_Error` returned by `wp_insert_user()` can be passed through `absint()` before error handling, coercing the value to integer `1`. An unauthenticated attacker can exploit this by registering with a username between **61 and 70 characters**, causing the plugin to generate an autologin nonce for **user ID 1**, which is commonly the site administrator. Successful exploitation can result in full administrative takeover of affected WordPress sites, particularly where **user ID 1** still belongs to an administrator account. Reports said roughly **40,000 sites** were exposed. The issue was patched in **`3.16.5`**, and defenders were urged to update immediately, review administrator accounts for unauthorized access, and verify whether the default administrator mapping to user ID 1 remains in place. Wordfence said firewall protections were released first to paid customers and later to free users.
Aug 17, 2026