CVE-2026-14444: WP Fusion Pro Privilege Escalation Flaw

CVE-2026-14444 Overview

The WP Fusion (Pro) plugin for WordPress contains a privilege escalation vulnerability in all versions up to and including 3.47.13. The flaw resides in the thrivecart() function of the ThriveCart Auto Login handler, which fails to perform sufficient authorization checks on the role parameter. Authenticated attackers with Subscriber-level access or above who possess the access_key can create administrator accounts and take full control of the affected WordPress site. The access_key is intentionally distributed to ThriveCart customers as part of the documented setup process, lowering the barrier to exploitation. The vulnerability is only exploitable when the ThriveCart Auto Login option is enabled. This weakness is tracked under [CWE-269: Improper Privilege Management].

Critical Impact
Authenticated Subscriber-level attackers holding the shared access_key can create new administrator accounts and gain full control of the WordPress site.

Affected Products

WP Fusion (Pro) plugin for WordPress, all versions up to and including 3.47.13
WordPress installations with the ThriveCart Auto Login option enabled
Sites where the ThriveCart access_key has been distributed to customers

Discovery Timeline

2026-09-07 - CVE-2026-14444 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-14444

Vulnerability Analysis

The vulnerability originates in the thrivecart() function of the ThriveCart Auto Login handler in WP Fusion (Pro). This function processes incoming requests to provision or authenticate ThriveCart-linked users but does not validate whether the caller is authorized to assign privileged WordPress roles. Because the role parameter is accepted from the request without an authorization check, an authenticated user can request the administrator role during account creation.

The attack requires two conditions. First, the ThriveCart Auto Login option must be enabled on the target site. Second, the attacker must know the access_key value, which the vendor documentation instructs administrators to share with ThriveCart customers. This distribution model means anyone who has purchased through the merchant may hold a valid key.

Successful exploitation results in a new administrator account controlled by the attacker. From there, the attacker can install plugins, modify content, exfiltrate data, or pivot to the underlying server. According to the Wordfence advisory, exploitation requires Subscriber-level authentication combined with the access_key.

Root Cause

The root cause is missing authorization on the role parameter within the thrivecart() handler. The function trusts client-supplied role data instead of restricting assignable roles to non-privileged defaults. This is a classic [CWE-269] Improper Privilege Management flaw compounded by reliance on a shared secret that is intentionally distributed to customers.

Attack Vector

The attack vector is network-based against the WordPress site. An authenticated user with Subscriber-level access sends a crafted request to the ThriveCart Auto Login endpoint containing the access_key and a role parameter set to administrator. The handler creates the account with the requested role, granting the attacker persistent administrative access. No user interaction is required beyond the attacker's own authenticated session.

No verified proof-of-concept code is available. See the Wordfence Vulnerability Analysis for further technical details.

Detection Methods for CVE-2026-14444

Indicators of Compromise

Newly created WordPress users with the administrator role that do not correspond to legitimate staff onboarding
Requests to the ThriveCart Auto Login endpoint containing a role parameter set to administrator or other privileged values
User accounts created shortly after Subscriber-level logins originating from unusual IP addresses or user agents

Detection Strategies

Audit the WordPress wp_users and wp_usermeta tables for administrator accounts created after WP Fusion (Pro) 3.47.13 was installed
Review web server access logs for POST requests to WP Fusion ThriveCart handler URLs that include the role parameter
Correlate account creation events with active Subscriber sessions to identify unexpected privilege transitions

Monitoring Recommendations

Enable WordPress audit logging plugins to record user role changes and new account creation events
Alert on any account creation event where the assigned role is administrator outside of approved provisioning workflows
Monitor plugin installation, theme edits, and file writes performed by newly created administrator accounts

How to Mitigate CVE-2026-14444

Immediate Actions Required

Update WP Fusion (Pro) to a version later than 3.47.13 once the vendor releases a patched build
Disable the ThriveCart Auto Login option until the plugin is patched to eliminate the exploitable code path
Rotate the ThriveCart access_key after patching, since the current value has been distributed to customers
Review and remove any unauthorized administrator accounts identified during log analysis

Patch Information

Refer to the WP Fusion Change Log for the fixed release addressing CVE-2026-14444. Administrators should verify the installed version after upgrade and confirm that the ThriveCart handler enforces role restrictions. The Wordfence Vulnerability Analysis documents the affected function and remediation guidance.

Workarounds

Disable the ThriveCart Auto Login feature in WP Fusion (Pro) settings until a patched version is available
Restrict Subscriber-level registration on the WordPress site to trusted users only
Deploy a Web Application Firewall rule to block requests to the ThriveCart handler that include a role parameter with privileged values
Rotate the ThriveCart access_key and limit its distribution to only active, trusted ThriveCart customers

bash

# Configuration example: temporarily disable the vulnerable feature via WP-CLI
wp option get wpf_options --format=json | \
  jq '.thrivecart_auto_login = false' | \
  wp option update wpf_options --format=json