{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-14328/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-14328"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress \u003c= 4.4.1"],"_cs_severities":["high"],"_cs_tags":["wordpress","web","privilege-escalation","cve-2026-14328"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Eazy Plugin Manager - Powerful Plugin Management Solution for WordPress plugin, affecting all versions up to and including 4.4.1, contains a critical privilege escalation vulnerability identified as CVE-2026-14328. This flaw stems from insufficient authorization within the \u003ccode\u003ewp_ajax_pos_get_option\u003c/code\u003e AJAX handler, which fails to perform capability checks, relying only on a localized nonce. This handler allows authenticated attackers with Subscriber-level access or higher to retrieve arbitrary WordPress option values. Coupled with the publicly accessible \u003ccode\u003eadmin_login_endpoint_handler\u003c/code\u003e REST endpoint (\u003ccode\u003eGET /wp-json/epm/v1/admin/login\u003c/code\u003e), which authenticates users based on a whirlpool hash of values stored in specific options, attackers can extract critical credentials (\u003ccode\u003esite_url\u003c/code\u003e, \u003ccode\u003econnection_key\u003c/code\u003e, \u003ccode\u003eremote_user_id\u003c/code\u003e), calculate the necessary \u003ccode\u003eauth_key\u003c/code\u003e, and bypass authentication to gain Administrator-level access and fully compromise the WordPress site. Exploitation requires the plugin's remote connection feature to be actively configured.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn authenticated attacker with Subscriber-level access or higher initiates a request to the vulnerable \u003ccode\u003ewp_ajax_pos_get_option\u003c/code\u003e AJAX handler.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the insufficient authorization vulnerability to request the \u003ccode\u003eeazywp_connecting_info\u003c/code\u003e and \u003ccode\u003eeazywp_connection\u003c/code\u003e WordPress options.\u003c/li\u003e\n\u003cli\u003eThe plugin's AJAX handler, failing to check user capabilities, returns the values of the requested options, which include sensitive data like \u003ccode\u003esite_url\u003c/code\u003e, \u003ccode\u003econnection_key\u003c/code\u003e, and \u003ccode\u003eremote_user_id\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the retrieved \u003ccode\u003esite_url\u003c/code\u003e, \u003ccode\u003econnection_key\u003c/code\u003e, and \u003ccode\u003eremote_user_id\u003c/code\u003e values to compute the required \u003ccode\u003eauth_key\u003c/code\u003e via a whirlpool hash algorithm as expected by the plugin.\u003c/li\u003e\n\u003cli\u003eThe attacker then makes a GET request to the publicly accessible \u003ccode\u003eadmin_login_endpoint_handler\u003c/code\u003e REST endpoint at \u003ccode\u003e/wp-json/epm/v1/admin/login\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe computed \u003ccode\u003eauth_key\u003c/code\u003e is supplied to this endpoint, which validates it against the stored whirlpool hash of the sensitive options.\u003c/li\u003e\n\u003cli\u003eUpon successful validation, the attacker is granted Administrator authentication cookies.\u003c/li\u003e\n\u003cli\u003eWith Administrator authentication cookies, the attacker achieves full site takeover of the compromised WordPress instance.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-14328 results in a complete site takeover by an authenticated attacker, allowing them to gain Administrator-level privileges on the affected WordPress site. This grants the attacker full control over the website's content, users, themes, plugins, and settings. Attackers could deface the site, inject malicious code, exfiltrate sensitive data, or use the compromised site for further malicious activities, such as hosting malware or launching phishing campaigns. The prerequisite for exploitation is that the Eazy Plugin Manager's remote connection feature must be enabled and configured on the WordPress site.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the \u0026quot;Eazy Plugin Manager - Powerful Plugin Management Solution for WordPress\u0026quot; plugin to a patched version beyond 4.4.1 to remediate CVE-2026-14328.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rules to your SIEM to detect attempts at exploiting the \u003ccode\u003ewp_ajax_pos_get_option\u003c/code\u003e AJAX handler and the \u003ccode\u003eadmin_login_endpoint_handler\u003c/code\u003e REST endpoint.\u003c/li\u003e\n\u003cli\u003eReview web server logs for suspicious requests to \u003ccode\u003ewp-admin/admin-ajax.php\u003c/code\u003e with \u003ccode\u003eaction=pos_get_option\u003c/code\u003e and \u003ccode\u003eoption_name\u003c/code\u003e parameters, especially for \u003ccode\u003eeazywp_connecting_info\u003c/code\u003e or \u003ccode\u003eeazywp_connection\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for GET requests to \u003ccode\u003e/wp-json/epm/v1/admin/login\u003c/code\u003e that include an \u003ccode\u003eauth_key\u003c/code\u003e parameter, as this indicates an attempted login using the computed key.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T10:20:01Z","date_published":"2026-07-28T10:20:01Z","id":"https://feed.craftedsignal.io/briefs/2026-07-eazy-plugin-manager-privesc/","summary":"The Eazy Plugin Manager - Powerful Plugin Management Solution for WordPress plugin for WordPress (versions up to and including 4.4.1) is vulnerable to privilege escalation (CVE-2026-14328), allowing authenticated attackers with Subscriber-level access to read sensitive WordPress options, compute an authentication key, and obtain Administrator authentication cookies, leading to full site takeover if the plugin's remote connection feature is configured.","title":"Privilege Escalation in Eazy Plugin Manager for WordPress (CVE-2026-14328)","url":"https://feed.craftedsignal.io/briefs/2026-07-eazy-plugin-manager-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-14328","version":"https://jsonfeed.org/version/1.1"}