CVE-2026-14805 Overview
The Consulting theme for WordPress contains a privilege escalation vulnerability affecting all versions up to and including 6.7.16. The flaw allows authenticated attackers with subscriber-level access to gain administrator privileges by chaining two weaknesses. An unprotected AJAX endpoint permits arbitrary transient manipulation, while a legacy developer access login mechanism authenticates users based on that transient value. Together, these flaws enable full account takeover of any existing user, including administrators. The vulnerability is tracked under [CWE-269: Improper Privilege Management].
Critical Impact
Authenticated subscribers can escalate to administrator by setting a predictable transient value and visiting a crafted developer access URL, resulting in full site compromise.
Affected Products
- Consulting theme for WordPress, versions up to and including 6.7.16
- admin/admin-notices/classes/STMHandler.php component
- admin/classes/stm-theme-support.php component
Discovery Timeline
- 2026-09-15 - CVE-2026-14805 published to the National Vulnerability Database (NVD)
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-14805
Vulnerability Analysis
The privilege escalation stems from two distinct flaws that combine into a full authentication bypass. The masterstudy_ms_stm_set_discard_transient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient key from the request. The endpoint performs no capability checks and does not validate a WordPress nonce. Any authenticated user, including a subscriber, can set arbitrary transient values through this endpoint.
The second flaw resides in the developer access login mechanism in admin/classes/stm-theme-support.php. When operating in legacy string mode, this handler authenticates users based on the value of the stm_developer_access_token transient without proper cryptographic validation. An attacker sets the transient to a known value such as 1, then visits the developer access URL. The handler compares the supplied token against the attacker-controlled transient and logs the attacker in as the requested username.
Root Cause
The root cause is a missing authorization boundary on the transient-setting endpoint combined with reliance on non-cryptographic value comparison for authentication. The developer access mechanism trusts transient state as an authentication factor without HMAC verification or randomized token generation. This design allows any authenticated user to control the input used for authentication decisions.
Attack Vector
Exploitation requires network access and any authenticated WordPress account at subscriber level or higher. The attacker sends an AJAX request to admin-ajax.php invoking masterstudy_ms_stm_set_discard_transient with the stm_developer_access_token key set to a predictable value. The attacker then visits the developer access URL supplying the same token value and a target username. The WordPress session cookie is issued for the targeted administrator account, granting full site control. Refer to the Wordfence Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-14805
Indicators of Compromise
- POST requests to wp-admin/admin-ajax.php with action=masterstudy_ms_stm_set_discard_transient originating from low-privilege user sessions
- Presence of the stm_developer_access_token transient in the wp_options table with a short, predictable value such as 1
- Unexpected administrator logins from accounts that were recently subscribers
- New administrator accounts or modified user roles in the wp_usermeta table
Detection Strategies
- Audit WordPress access logs for the masterstudy_ms_stm_set_discard_transient action invoked by non-administrator users
- Correlate transient modification events with subsequent successful authentication for privileged accounts
- Deploy web application firewall rules that block the vulnerable AJAX action from users lacking manage_options capability
Monitoring Recommendations
- Enable WordPress audit logging for role and capability changes on all user accounts
- Monitor the wp_options table for insertion of _transient_stm_developer_access_token entries
- Alert on session cookies issued for administrator accounts immediately following AJAX activity from lower-privilege sessions
How to Mitigate CVE-2026-14805
Immediate Actions Required
- Update the Consulting theme to a version above 6.7.16 once the vendor publishes a patched release
- Audit all administrator accounts and remove any unauthorized users created after the theme was installed
- Rotate credentials and force password resets for all privileged WordPress users
- Review the wp_options table and delete stale stm_developer_access_token transient entries
Patch Information
Refer to the ThemeForest Product Changelog for the fixed release. Apply the update through the WordPress admin theme updater or by replacing the theme files manually. Verify version metadata in style.css after applying the update.
Workarounds
- Restrict access to wp-admin/admin-ajax.php for the masterstudy_ms_stm_set_discard_transient action using a web application firewall rule
- Disable subscriber-level account registration until the theme is patched
- Remove or comment out the developer access login handler in admin/classes/stm-theme-support.php if patching is not immediately possible
- Delete any existing stm_developer_access_token transient values from the database
# Remove the vulnerable transient from the WordPress database
wp transient delete stm_developer_access_token
# Verify current Consulting theme version
wp theme get consulting --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
