CyberRota
← Ana sayfaya dön

CVE-2026-8206

CRITICAL · CVSS 9.8 EPSS %1.26

Kaynak: NVD + CISA KEV + EPSS · Yayınlanma: 2026-06-02T04:17:03.550 · Çekilme zamanı: 2026-06-30T12:07:35.659813+00:00

CyberRota Yorumu

Detaylı analiz gerekiyor.

CVE
CVE-2026-8206
Severity
CRITICAL
CVSS
9.8
EPSS
%1.26
WordPress

Orijinal NVD Açıklaması

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.