CVE-2026-8206 — Themeum Kirki WordPress Plugin Password Reset Email Redirect Privilege Escalation

This research provides technical context that security teams can use for monitoring and validation.

A retrospective on CVE-2025-39964, an AF_ALG race condition causing out-of-bounds scatterlist access in the Linux kernel. Exploitation yields root and a Docker container escape.

Ubuntu Server silently puts the first user in the lxd group, root-equivalent by design. The seeded lxd-installer socket lets lxd users install LXD password-free and reach host root; vendor won't fix.

An unauthenticated stored XSS (CVE-2026-93485) in WordPress core's wpautop() turns crafted comments into zero-click XSS, escalating to RCE via the admin session. Fixed in 7.1.1, backported to 4.7.36.

Password reset tokens derived from predictable data like an MD5-hashed timestamp let attackers hijack any account including admins; use random tokens, ownership checks and rate limiting.

The password-reset flow on Yahoo's small business platform carried a client-controlled 'uuid'; a signature/user-ID mismatch let attackers permanently take over other users' accounts.