Attack Chain

1. An authenticated attacker with Subscriber-level access or higher initiates a request to the vulnerable wp_ajax_pos_get_option AJAX handler.
2. The attacker leverages the insufficient authorization vulnerability to request the eazywp_connecting_info and eazywp_connection WordPress options.
3. The plugin's AJAX handler, failing to check user capabilities, returns the values of the requested options, which include sensitive data like site_url, connection_key, and remote_user_id.
4. The attacker uses the retrieved site_url, connection_key, and remote_user_id values to compute the required auth_key via a whirlpool hash algorithm as expected by the plugin.
5. The attacker then makes a GET request to the publicly accessible admin_login_endpoint_handler REST endpoint at /wp-json/epm/v1/admin/login.
6. The computed auth_key is supplied to this endpoint, which validates it against the stored whirlpool hash of the sensitive options.
7. Upon successful validation, the attacker is granted Administrator authentication cookies.
8. With Administrator authentication cookies, the attacker achieves full site takeover of the compromised WordPress instance.

Impact

Successful exploitation of CVE-2026-14328 results in a complete site takeover by an authenticated attacker, allowing them to gain Administrator-level privileges on the affected WordPress site. This grants the attacker full control over the website's content, users, themes, plugins, and settings. Attackers could deface the site, inject malicious code, exfiltrate sensitive data, or use the compromised site for further malicious activities, such as hosting malware or launching phishing campaigns. The prerequisite for exploitation is that the Eazy Plugin Manager's remote connection feature must be enabled and configured on the WordPress site.

Recommendation

• Immediately update the "Eazy Plugin Manager - Powerful Plugin Management Solution for WordPress" plugin to a patched version beyond 4.4.1 to remediate CVE-2026-14328.
• Deploy the provided Sigma rules to your SIEM to detect attempts at exploiting the wp_ajax_pos_get_option AJAX handler and the admin_login_endpoint_handler REST endpoint.
• Review web server logs for suspicious requests to wp-admin/admin-ajax.php with action=pos_get_option and option_name parameters, especially for eazywp_connecting_info or eazywp_connection.
• Monitor web server logs for GET requests to /wp-json/epm/v1/admin/login that include an auth_key parameter, as this indicates an attempted login using the computed key.