CVE-2026-14356: FleekDash V2 Auth Bypass Vulnerability

CVE-2026-14356 Overview

CVE-2026-14356 is an authorization bypass vulnerability in the FleekDash V2 plugin for WordPress, affecting all versions up to and including 2.6.2.2. The plugin fails to verify whether a user is authorized to perform account modification actions. Authenticated attackers with subscriber-level access can overwrite the email address and password of any WordPress user, including administrators. The public /wp-json/fleekdash/v1/register endpoint compounds the risk by auto-provisioning a Subscriber-role account and returning a valid REST nonce, regardless of the site's users_can_register setting. Unauthenticated attackers can chain these behaviors to self-provision credentials and complete full site compromise.

Critical Impact
Attackers can take over any administrator account and gain complete control of the affected WordPress site, starting from an unauthenticated position.

Affected Products

FleekDash V2 plugin for WordPress
All versions up to and including 2.6.2.2
WordPress sites running the vulnerable plugin, regardless of users_can_register configuration

Discovery Timeline

2026-07-30 - CVE-2026-14356 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-14356

Vulnerability Analysis

The vulnerability is a missing authorization flaw classified under [CWE-862]. The FleekDash V2 plugin exposes REST API functionality that modifies user account attributes without validating whether the caller owns the target account or holds sufficient privileges. As a result, any authenticated Subscriber can submit requests that overwrite the email and password of arbitrary users, including administrators.

A secondary design flaw amplifies the impact. The /wp-json/fleekdash/v1/register endpoint provisions a Subscriber account and returns a valid REST nonce even when site owners have disabled open registration. This bypasses the standard WordPress control that gates account creation, allowing any remote attacker to obtain the credentials needed to reach the vulnerable endpoint in a single request.

Root Cause

The root cause lies in the UserController.php logic within the plugin source, which processes account update requests without a capability check or ownership verification. The controller trusts client-supplied identifiers to select the target user and applies the new email and password without confirming the requester is authorized to modify that account.

Attack Vector

The attack is remote and requires no user interaction. An unauthenticated attacker first calls the public registration endpoint to obtain a Subscriber account and a valid REST nonce. The attacker then issues a follow-up request to the vulnerable account update endpoint, supplying an administrator user identifier along with attacker-controlled email and password values. After the update completes, the attacker authenticates as the administrator and executes plugin installation, content changes, or arbitrary PHP execution through standard WordPress administrative features.

Code-level details are available in the WordPress Plugin File Reference and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-14356

Indicators of Compromise

Unexpected POST requests to /wp-json/fleekdash/v1/register from unfamiliar source IP addresses
Requests to FleekDash user update endpoints containing user IDs the caller does not own
Administrator accounts with recently changed email addresses or password hashes that were not initiated by the account owner
New Subscriber-role accounts created shortly before administrator credential changes

Detection Strategies

Review WordPress user metadata for unexplained changes to user_email and user_pass fields on privileged accounts
Correlate access logs to identify short intervals between fleekdash/v1/register calls and subsequent FleekDash account update calls from the same IP
Alert when non-administrator users invoke FleekDash REST routes that target user IDs other than their own

Monitoring Recommendations

Enable REST API request logging for the fleekdash/v1 namespace and forward logs to a centralized analytics pipeline
Monitor WordPress audit logs for administrator email or password modifications not tied to a valid administrator session
Track sudden increases in Subscriber account registration volume, particularly from single source IPs or ASNs

How to Mitigate CVE-2026-14356

Immediate Actions Required

Deactivate and remove the FleekDash V2 plugin on all WordPress sites until a fixed release is confirmed installed
Audit all administrator and editor accounts for unauthorized email or password changes and reset credentials as needed
Delete any Subscriber accounts created through /wp-json/fleekdash/v1/register that cannot be attributed to legitimate users
Rotate WordPress secret keys and salts in wp-config.php to invalidate any harvested session tokens

Patch Information

A fixed version resolving CVE-2026-14356 in FleekDash V2 was not identified in the referenced advisories at publication time. Site administrators should consult the Wordfence Vulnerability Report and the plugin repository for the latest fixed release before reinstalling the plugin.

Workarounds

Block external access to the /wp-json/fleekdash/v1/ REST namespace at the web application firewall or reverse proxy layer
Restrict access to /wp-json/ to authenticated administrative sessions where feasible, using IP allowlists or authentication proxies
Set users_can_register to false and enforce registration controls at the web server layer, recognizing that this alone does not stop the vulnerable endpoint

bash

# Example nginx rule to block the vulnerable REST namespace
location ~* /wp-json/fleekdash/v1/ {
    return 403;
}