Junglewise Threat Intelligence

CVE-2026-14328: Eazy Plugin Manager privilege escalation via AJAX and REST API

CVE-2026-14328 · Severity: high · CVSS 8.8 · Published 2026-07-28

Executive brief

A vulnerability in the Eazy Plugin Manager for WordPress allows users with low-level access, such as subscribers, to gain full administrative control over a website. This occurs because the plugin inadvertently exposes sensitive configuration data that can be used to bypass security checks. If the plugin's remote connection feature is enabled, an attacker can exploit this to take over the site, potentially leading to data theft or complete service disruption.

Technical details

The vulnerability stems from a lack of capability checks in the `wp_ajax_pos_get_option` AJAX handler, which only validates a nonce available to any logged-in user. This allows an attacker with Subscriber-level privileges to retrieve arbitrary WordPress options, specifically sensitive keys like `connection_key` and `remote_user_id`. By combining these values, an attacker can generate a valid authentication hash for the publicly accessible `admin/login` REST endpoint. Successful exploitation results in the issuance of Administrator authentication cookies, granting full site takeover. This attack requires the plugin's remote connection feature to be active and configured.

Affected products

  • eazyplugins Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress up to, and including, 4.4.1

Timeline

  • 2026-07-28: disclosed: Published by Wordfence and NVD

References