WordPress CVE-2026-8206: unauthenticated admin takeover via the Kirki plugin

> In short: CVE-2026-8206 allows unauthenticated administrator takeover on WordPress sites using the Kirki plugin versions 6.0.0 to 6.0.6. CVSS 9.8, active exploitation confirmed. Fix: Kirki 6.0.7. Around 150,000 sites exposed.

Why a SaaS vendor should read this

You're not a WordPress site — but your marketing site, blog, help center, or careers page very often run on WordPress. And a compromised WordPress next to your SaaS product is a problem: phishing hosted on your domain, malicious code served to your visitors, reputation damage at the exact moment a prospect is checking your credibility.

This CVE is a textbook case of plugin risk: the flaw isn't in WordPress, but in an extension installed on hundreds of thousands of sites.

The flaw in two sentences

The Kirki plugin (page builder and customization) exposes a password-reset REST endpoint. In the handle_forgot_password() function, this endpoint accepts an attacker-supplied email address instead of using the target account's registered address.

Concretely: an attacker sends a request specifying the username admin and *their own* email address. The reset link is sent to them. They take over the administrator account. No authentication required.

Why it's this severe

Three factors stack up:

This is exactly the flaw profile that mass scanners and botnets exploit within hours of disclosure.

The real subject: the passive security of reset logic

This CVE illustrates a design error found well beyond WordPress: trusting user-supplied data to decide where to send a secret. The reset link is a secret. Sending it to an address controlled by the requester, rather than to the account's registered address, is like handing the key to whoever asks for it.

The same class of bug shows up in in-house SaaS: reset endpoints that take the email in the request, predictable tokens, no binding between the token and the account. It's one of the areas we test systematically, because it's both critical and easy to miss.

What to do, in order

What this says about your surface

The WordPress next to your SaaS is part of your attack surface, even if it holds no customer data. It shares your domain, your brand, and sometimes more infrastructure than you'd think. Our audits cover everything exposed under your name — not just the product. If you want to know what a third party can already reach, from your marketing site to your API, start with an external review: first read in 48h.