Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'

Description

The plugin is vulnerable to privilege escalation via account takeover due to accepting an arbitrary email address when a username is supplied in the password reset request. This makes it possible for unauthenticated attackers to have the password reset link for any registered user — including administrators — sent to an attacker-controlled email address, leading to full account takeover.