{"uuid": "783cc003-d558-4428-ad1c-9c51aeffe343", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "seen", "source": "https://t.me/cve0day/436", "content": "CVE-2026-8206\n\nThe Kirki \u2013 Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.", "creation_timestamp": "2026-08-27T15:00:06.822911Z"}