The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation through an unchecked password reset mechanism. The flaw allows an unauthenticated attacker to supply any email address while requesting a password reset for any username on the site. This results in a reset link being sent to the attacker's address, effectively granting them control over the target account and elevating privileges to that user level.

All installations of the Kirki plugin released by themeum, versions 6.0.0 through 6.0.6 on WordPress sites are affected. The flaw resides in the plugin’s "handle_forgot_password" functionality and does not impact other WordPress components or plugins.

The vulnerability carries a CVSS score of 9.8, indicating critical severity, and the EPSS score is not available. It is not listed in the CISA KEV catalog. The attack vector is purely unauthenticated; an attacker needs only a target username and can specify any email address in the reset request. The plugin then sends a password‑reset link to that supplied address, giving the attacker control of the user account and elevating privileges to that role.