WordPress Plugins Kirki and Burst Statistics Vulnerabilities Expose Websites to Attacks
Security vulnerabilities in the Kirki and Burst Statistics WordPress plugins have put hundreds of thousands of websites at risk. The Kirki plugin, used for website customization, has a critical flaw in versions 6.0.0 to 6.0.6 that allows unauthenticated attackers to escalate privileges and take over accounts. This vulnerability, tracked as CVE-2026-8206, involves a flaw in the password reset process, enabling attackers to reset passwords for high-privileged accounts. Similarly, the Burst Statistics plugin, which provides analytics for WordPress sites, has an authentication bypass vulnerability in versions 3.4.0 to 3.4.1.1. This flaw allows attackers to gain administrator-level access through the REST API. Users are advised to update to Kirki version 6.0.7 and Burst Statistics version 3.4.2 to mitigate these risks. 
