CVE-2026-8206: Kirki Unauthenticated Account Takeover via Email Redirect (CVSS 9.8)

CVE-2026-8206 (CVSS 9.8) in Kirki plugin 6.0.0–6.0.6 lets unauthenticated attackers redirect password reset emails to steal any WordPress account.