SECURITYJun 2 · 22:12 UTCBLEEPING COMPUTERBill Toulas

Critical Kirki flaw exploited to hijack WordPress admin accounts

Hackers are exploiting a critical privilege escalation vulnerability (CVE-2026-8206) in the Kirki plugin for WordPress to take over any user account, including administrators. The flaw allows unauthorized access to WordPress admin accounts through the Kirki plugin.

Nexus surfaces and summarizes. The full story lives at the source.

Mentioned

Kirki plugintopicCVE-2026-8206topicWordPresstopichackersperson

Spot something wrong with this article?Report a problem →

Forward this

Related Signal

Adjacent reporting

SECURITYMay 31 · 14:06 UTC
WP Maps Pro bug exploited to create admin accounts on WordPress sites
SECURITYMay 14 · 21:07 UTC
Hackers exploit auth bypass flaw in Burst Statistics WordPress plugin
SECURITYMay 21 · 10:55 UTC
Microsoft Warns of Two Actively Exploited Defender Vulnerabilities
SECURITYJun 1 · 08:45 UTC
Critical WP Maps Pro Flaw Actively Exploited to Create Admin Accounts
SECURITYApr 30 · 22:48 UTC
The Internet Is Falling Down- CPanel/WHM Authentication Bypass CVE-2026-41940
SECURITYMay 3 · 06:26 UTC
CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV