Orca Security: CVE-2026-8206

What to do

The existing summary already carries the CVE, the CVSS 9.8 rating, the vulnerable handle_forgot_password() mechanism, the 6.0.0–6.0.6 version range, the active-exploitation count and the 6.0.7 fix. What it omits is the remediation and triage guidance, plus one exploitation precondition — that is the reason this document exists.

• Upgrade to Kirki 6.0.7 or later immediately. This is the primary fix.
• Audit user registries for unauthorized accounts or unexpected privilege changes — the attack yields admin, so evidence of compromise lives in the user table.
• Review site files for unauthorized plugins, themes, or web shells; the page names web-shell installation and data exfiltration as post-exploitation actions.
• Deploy WAF rules blocking malicious REST API requests to the password-reset endpoint. Patchstack offers automatic virtual patching for organizations that need time to schedule the update.

Exploitation precondition

The attacker sends a crafted password-reset request carrying a target username plus an attacker-controlled email; the endpoint mails the reset link to the attacker's address rather than the registered one. No authentication is required. The page adds that sites are particularly at risk where the frontend account-management features are enabled — a configuration detail the summary does not mention, and a useful filter when deciding which installs to prioritize.

Caveats

The install figures are the same the summary already gives (150,000 of 500,000+ unpatched). Beyond the mitigation list and the frontend-account-management condition, the remainder of the page is Orca product positioning (agentless SideScanning to detect vulnerable Kirki installs) and restated impact language, neither of which adds actionable detail.