Back Ground.News

Kirki, Burst Statistics WordPress Plugin Flaws in Attackers' Crosshairs

Ground.News • June 3, 2026

A critical security flaw in the widely used Kirki WordPress plugin has exposed over 500,000 websites to potential account takeover attacks, with researchers warning that approximately 150,000 sites are actively vulnerable due to affected versions. Tracked as CVE-2026-8206 with a CVSS score of 9.8, the vulnerability impacts Kirki plugin versions 6.0.0 through 6.0.6. The issue allows unauthenticated attackers to escalate privileges by abusing a fl…

Threat actors are exploiting vulnerable Kirki and Burst Statistics deployments to elevate privileges and take over websites.

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in BeyondTrust Software Requires Immediate Patching BeyondTrust has issued a warning regarding a critical remote code execution (RCE) vulnerability in its Remote Support and Privileged Remote Access software. The flaw, tracked as CVE-2026-1731, allows unauthenticated attackers to execute arbitrary code remotely and affects versions 25.3.1 or earlier of Remote Support and 24.3.4 or earlier of Privileged Remote Access. Users are advised to apply the patches released on February 6, 2026, to mitigate the risk of exploitation. 1495 sources 67

Extracted Entities

Kirki, Burst Statistics WordPress Plugin Flaws in Attackers' Crosshairs

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (2)

Platforms (1)