Executive brief
The Consulting WordPress theme is vulnerable to privilege escalation, allowing any authenticated user (even those with minimal subscriber-level permissions) to gain full administrator access. An attacker exploits a flawed developer access mechanism by manipulating transient values through an unprotected AJAX endpoint, bypassing security checks. This puts all websites using the theme at risk of complete takeover and unauthorized control of site content and user data.
Technical details
The vulnerability is a privilege escalation stemming from two chained flaws in the theme's admin functionality. First, the masterstudy_ms_stm_set_discard_transient AJAX endpoint lacks capability checks and nonce validation, allowing arbitrary transient keys to be set. Second, the developer access login mechanism in stm-theme-support.php authenticates users based on transient values without proper cryptographic validation when in legacy string mode. An authenticated attacker with subscriber-level access can set the stm_developer_access_token transient to a known value and then visit a crafted URL to authenticate as any existing user, including administrators. The vulnerability requires prior authentication but allows escalation from minimal privileges to full administrative control. Patches are available in versions after 6.7.16.
Affected products
- The Consulting Consulting up to and including 6.7.16
Timeline
- 2026-09-15: disclosed