{"uuid": "86f21b32-095e-498a-82b7-ce75eef8965d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8206", "type": "published-proof-of-concept", "source": "https://t.me/cve0day/436", "content": "CVE-2026-8206\n\nThe Kirki \u2013 Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.", "creation_timestamp": "2026-08-28T00:00:33.663220Z"}