CVE-2026-14328 Overview
CVE-2026-14328 is a privilege escalation vulnerability in the Eazy Plugin Manager WordPress plugin (also known as Plugins on Steroids) affecting all versions up to and including 4.4.1. The flaw allows authenticated attackers with Subscriber-level access to obtain Administrator authentication cookies and fully take over the affected WordPress site. The issue stems from insufficient authorization checks on the wp_ajax_pos_get_option AJAX handler combined with a publicly accessible REST endpoint at /wp-json/epm/v1/admin/login. This vulnerability is tracked under [CWE-269: Improper Privilege Management].
Critical Impact
Subscriber-level attackers can read sensitive plugin options, compute a valid auth_key, and authenticate as an Administrator, resulting in complete site compromise.
Affected Products
- Eazy Plugin Manager (Plugins on Steroids) for WordPress — all versions up to and including 4.4.1
- WordPress sites where the plugin's remote connection feature has been configured
- Sites with populated eazywp_connecting_info and eazywp_connection options
Discovery Timeline
- 2026-07-28 - CVE-2026-14328 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-14328
Vulnerability Analysis
The vulnerability chains two independent weaknesses in the Eazy Plugin Manager plugin to escalate a Subscriber account to Administrator. The first weakness is the wp_ajax_pos_get_option AJAX handler, which returns the value of any arbitrary WordPress option via get_option(). The handler validates only a nonce, and that nonce is localized to every logged-in admin-area user through admin_enqueue_scripts. No capability check is performed before disclosing option values.
The second weakness lives in the admin_login_endpoint_handler REST endpoint registered at GET /wp-json/epm/v1/admin/login. The endpoint is exposed publicly and authenticates callers solely by verifying a whirlpool hash computed from values stored in the same plugin options that the AJAX handler leaks. Because the secret material and the verification logic depend on data an attacker can now read, the endpoint can be called with a valid auth_key to return Administrator authentication cookies.
Root Cause
The root cause is improper privilege management [CWE-269]. Nonce verification is treated as authorization, and the REST endpoint trusts a hash derived from readable options rather than a server-held secret or a capability check tied to the current user.
Attack Vector
An attacker with any authenticated role at Subscriber level or above logs into the WordPress site and reuses the nonce localized to their admin-area session. The attacker calls the wp_ajax_pos_get_option handler to retrieve the site_url, connection_key, and remote_user_id values from the eazywp_connecting_info and eazywp_connection options. Using those values, the attacker computes the whirlpool hash used as auth_key. The attacker then requests GET /wp-json/epm/v1/admin/login with the computed auth_key, receives Administrator cookies, and gains full control of the site. Exploitation requires that the plugin's remote connection feature was previously configured so the relevant options contain valid data.
Detection Methods for CVE-2026-14328
Indicators of Compromise
- Unexpected admin-ajax.php requests with action=pos_get_option originating from low-privileged user sessions.
- Requests to GET /wp-json/epm/v1/admin/login from external IP addresses or unknown user agents.
- New Administrator logins or session cookies issued shortly after Subscriber activity on the site.
- Modifications to plugins, themes, or wp_users following requests to the epm/v1/admin/login endpoint.
Detection Strategies
- Inspect web server access logs for the pos_get_option AJAX action tied to non-administrator user IDs.
- Alert on any successful HTTP 200 response from /wp-json/epm/v1/admin/login, since legitimate use is limited.
- Correlate low-privilege authentication events with subsequent Administrator-level activity from the same source IP or user agent.
Monitoring Recommendations
- Enable WordPress audit logging to capture role changes, plugin installs, and option reads.
- Monitor the eazywp_connecting_info and eazywp_connection options for unexpected access patterns.
- Forward WordPress and web server logs to a centralized analytics platform for retention and correlation.
How to Mitigate CVE-2026-14328
Immediate Actions Required
- Update the Eazy Plugin Manager plugin to a version later than 4.4.1 once a patched release is available from the vendor.
- Deactivate and remove the plugin if a patch is not yet available and the remote connection feature is in use.
- Rotate the connection_key and any related credentials stored in eazywp_connecting_info and eazywp_connection.
- Audit WordPress user accounts for unauthorized Administrator additions and revoke suspicious sessions.
Patch Information
At the time of publication, no fixed version is listed in the NVD entry. Review the Wordfence Vulnerability Analysis and the WordPress Plugin Code References for current status and code locations.
Workarounds
- Disable the plugin's remote connection feature so eazywp_connecting_info and eazywp_connection remain unpopulated.
- Restrict access to /wp-json/epm/v1/admin/login at the web server or WAF layer to trusted IP addresses.
- Limit Subscriber-level registrations and disable open user registration where not required.
- Block requests to admin-ajax.php with action=pos_get_option from non-administrator sessions using a WAF rule.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
