---
id: 6161
title: "CVE-2026-8206 — Themeum Kirki WordPress Plugin Password Reset Email Redirect Privilege Escalation"
cve: CVE-2026-8206
source_domain: aretiq.ai
source_url: "https://aretiq.ai/research/vul260602-cve-2026-8206-themeum-kirki-wordpress-plugin-password-reset-email-redirect-privilege-escalation/"
published_at: "2026-06-02T00:00:00Z"
tags: ["appsec", "vulnerability-research", "account-takeover", "privilege-escalation", "wordpress", "password-reset", "cve-2026-8206", "kirki"]
phying_url: "https://phying.com/item/6161"
lang: en
---

# CVE-2026-8206 — Themeum Kirki WordPress Plugin Password Reset Email Redirect Privilege Escalation

## Summary

CVE-2026-8206: Kirki 6.0.0–6.0.6 sends WordPress password-reset links to an attacker-supplied email, enabling unauthenticated takeover of any account including admin; fixed in 6.0.7.

## Intelligence Metadata

- **Sources:** aretiq.ai
- **CVE:** CVE-2026-8206
- **Published:** 2026-06-02T00:00:00Z
- **Original:** https://aretiq.ai/research/vul260602-cve-2026-8206-themeum-kirki-wordpress-plugin-password-reset-email-redirect-privilege-escalation/
- **Phying News:** https://phying.com/item/6161