CVE-2026-8206 is a critical privilege escalation vulnerability (CWE-269) in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin. The vulnerability arises because the plugin accepts an arbitrary email address when a username is provided during a password reset request. This allows unauthenticated attackers to send password reset links for any user to an attacker-controlled email address, enabling account takeover. The issue affects all versions from 6.0.0 up to and including 6.0.6. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an unauthenticated attacker to escalate privileges by taking over any user account on the affected WordPress site. This can lead to full compromise of user accounts, including administrative accounts, resulting in complete site control, data exposure, and potential further malicious activity. The CVSS v3.1 base score is 9.8, indicating critical severity with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the password reset functionality if possible and monitor for suspicious password reset requests. Avoid using the affected plugin versions (6.0.0 through 6.0.6) in production environments. Follow the vendor's updates closely for an official patch or temporary mitigation.