CVE-2026-14873: WordPress Bulk Password Reset Privilege Escalation

CVE-2026-14873 Overview

The Bulk Password Reset plugin for WordPress contains a missing authorization flaw [CWE-862] that enables authenticated attackers to take over arbitrary user accounts, including administrators. All versions up to and including 1.3.3 are affected. The plugin fails to validate a user's identity before updating account details such as email addresses and passwords. Attackers holding subscriber-level access or above can modify an administrator's email address, trigger a password reset, and gain full site control.

Critical Impact
A low-privileged authenticated user can escalate to administrator by rewriting arbitrary account attributes, resulting in full WordPress site takeover.

Affected Products

WordPress Bulk Password Reset plugin, versions up to and including 1.3.3
WordPress sites where the plugin is installed and active
Any user role from subscriber upward can trigger the flaw

Discovery Timeline

2026-09-10 - CVE-2026-14873 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-14873

Vulnerability Analysis

The vulnerability is a broken access control issue in the Bulk Password Reset plugin. The plugin exposes handlers that update user attributes without confirming that the requesting user owns or has authorization over the target account. An authenticated attacker with subscriber-level access can therefore alter another user's email address, including that of an administrator. Once the email address is attacker-controlled, the attacker uses the standard WordPress password reset flow to seize the target account. The result is a full account takeover chain composed of two ordinary operations that individually appear benign.

Root Cause

The root cause is missing authorization [CWE-862] on functions that mutate user account fields. The plugin does not verify that the target user identifier matches the current session user, nor does it enforce capability checks such as edit_user before applying the update. Relevant handlers reside in bulk_password_reset.php, including logic near lines 44, 594, 659, and 679, as referenced in the WordPress plugin source.

Attack Vector

The attack is network-based and requires an authenticated session with low privileges. The attacker submits a request to the vulnerable plugin endpoint that changes a target administrator's email address to an attacker-controlled inbox. The attacker then requests a WordPress password reset for the administrator account, receives the reset link at the substituted email, and sets a new password. User interaction is required only in the form of the standard email-based reset step. Additional technical detail is available in the Wordfence vulnerability report.

Detection Methods for CVE-2026-14873

Indicators of Compromise

Unexpected changes to administrator email addresses recorded in the WordPress wp_users table or in audit logs.
Password reset emails sent to unfamiliar external mail domains shortly after a low-privileged login.
Recent successful logins from subscriber accounts followed by administrator-level actions such as plugin installation or user creation.
Presence of the Bulk Password Reset plugin at version 1.3.3 or earlier on internet-facing WordPress sites.

Detection Strategies

Monitor HTTP requests to admin-ajax.php and plugin endpoints defined in bulk_password_reset.php that carry a user_id or email parameter not matching the session owner.
Correlate email-change events with immediate password-reset requests targeting the same account.
Alert on any administrator account whose email address changes outside of an approved change window.

Monitoring Recommendations

Enable a WordPress audit logging plugin to capture user profile updates, role changes, and password reset events.
Forward WordPress and web server logs to a centralized analytics platform for correlation with authentication telemetry.
Track plugin inventory to identify hosts still running Bulk Password Reset <= 1.3.3.

How to Mitigate CVE-2026-14873

Immediate Actions Required

Deactivate and remove the Bulk Password Reset plugin until a patched release is confirmed installed.
Audit all administrator accounts for unauthorized email address changes and reset credentials as needed.
Enforce multi-factor authentication for all administrator and editor accounts on affected WordPress sites.
Restrict user registration or lower-privileged self-service where feasible to reduce the attacker pool.

Patch Information

At the time of NVD publication on 2026-09-10, all versions up to and including 1.3.3 are listed as vulnerable. Site administrators should consult the Wordfence vulnerability report and the plugin's WordPress.org page for the latest patched release, and upgrade immediately once available.

Workarounds

Remove the plugin entirely if a fixed version is not yet published.
Apply a web application firewall rule that blocks unauthenticated and low-privileged requests to the plugin's user-update endpoints.
Restrict administrative endpoints to trusted IP ranges using web server access controls.

bash

# Configuration example: disable the plugin via WP-CLI until a patched version is verified
wp plugin deactivate bulk-password-reset
wp plugin delete bulk-password-reset