CVE-2026-14328 Privilege escalation in Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress
Authenticated subscribers can escalate to Administrator by exploiting insufficient authorization in AJAX handlers and REST endpoints to steal credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-14328?
CVE-2026-14328 is a high-severity vulnerability in eazyplugins Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress, published on 28 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the `wp_ajax_pos_get_option` AJAX handler, which verifies only a nonce that is localized to every logged-in admin-area user via `admin_enqueue_scripts` — without any capability check — before returning the value of any arbitrary WordPress option via `get_option()`, combined with the `admin_login_endpoint_handler` REST endpoint (`GET /wp-json/epm/v1/admin/login`) being registered as publicly accessible and authenticating callers solely by a whirlpool hash of values stored in those same options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the `site_url`, `connection_key`, and `remote_user_id` values stored in the `eazywp_connecting_info` and `eazywp_connection` options, compute the required `auth_key`, call the `admin/login` REST endpoint to obtain Administrator authentication cookies, and fully take over the site. Exploitation requires the plugin's remote connection feature to have been configured, as the `eazywp_connecting_info` and `eazywp_connection` options must be populated with valid credentials.
Weakness: CWE-269
Which versions are affected by CVE-2026-14328?
How do I fix CVE-2026-14328?
No fix has been published for CVE-2026-14328 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-14328 being exploited?
There is no known exploitation of CVE-2026-14328 in the wild and no public exploit code.
Sources
Also known as GHSA-8fxc-wrxg-769w.