Critical Kirki flaw exploited to hijack WordPress admin accounts

A critical vulnerability in the Kirki plugin for WordPress, identified as CVE-2026-8206, is being actively exploited by hackers to escalate privileges and hijack administrator accounts¹. This flaw allows attackers to take control of any user account, posing a significant threat to WordPress sites that have not applied the necessary patches. The Kirki plugin is widely used for customizing WordPress themes, making this vulnerability a high-risk issue for many site owners. As a result, administrators are advised to prioritize patching this vulnerability based on their exposure and evidence of exploitation. The active exploitation of CVE-2026-8206 expands the attack surface, making it essential for WordPress site owners to take immediate action to protect their sites. This vulnerability has significant implications for website security, so administrators must promptly address this issue to prevent potential takeovers and data breaches.