Is CVE-2026-14250 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14250 being exploited in the wild.

How severe is CVE-2026-14250?

Medium severity, with a CVSS score of 6.3, published 8 July 2026.

Which products and versions are affected?

ThemeHunk TH Login Registration up to, and including, 1.0.2.

Is there a fix for CVE-2026-14250?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-14250 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-14250?

Check whether you run ThemeHunk TH Login Registration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14250: Themehunk Login Registration privilege escalation in REST API

CVE-2026-14250 · Severity: medium · CVSS 6.3 · Published 2026-07-08

The Themehunk Login Registration plugin for WordPress, which manages user sign-ups and logins, contains a security flaw that allows unauthorized users to grant themselves elevated permissions. By exploiting this during the registration process, an attacker can create a new account with 'Editor' privileges instead of a standard 'Subscriber' role. This could allow an attacker to modify website content, delete pages, or access sensitive internal data.

Vendors: ThemeHunk.

Quick answers

Is CVE-2026-14250 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14250 being exploited in the wild.
How severe is CVE-2026-14250?: Medium severity, with a CVSS score of 6.3, published 8 July 2026.
Which products and versions are affected?: ThemeHunk TH Login Registration up to, and including, 1.0.2.
Is there a fix for CVE-2026-14250?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14250 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-14250?: Check whether you run ThemeHunk TH Login Registration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the handle_frontend_register() function within the /thlogin/v1/register REST endpoint. The root cause is improper validation of the 'role' parameter; the plugin checks the requested role against get_editable_roles() but fails to restrict it to a safe default. Because 'editor' is considered an editable role in many WordPress configurations, an unauthenticated attacker can supply this role during registration when public registration is enabled. This allows for the creation of high-privilege accounts via a single network request. A patch appears to be available in versions following 1.0.2.

Affected products

Themehunk TH Login Registration up to, and including, 1.0.2

Timeline

2026-07-08: disclosed
2026-07-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.