137 lines
6.5 KiB
JSON
137 lines
6.5 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-14328",
|
||
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Wordfence",
|
||
"dateReserved": "2026-07-01T12:29:08.320Z",
|
||
"datePublished": "2026-07-28T09:30:16.345Z",
|
||
"dateUpdated": "2026-07-28T14:00:19.271Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
|
||
"shortName": "Wordfence",
|
||
"dateUpdated": "2026-07-28T09:30:16.345Z"
|
||
},
|
||
"affected": [
|
||
{
|
||
"vendor": "eazyplugins",
|
||
"product": "Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress",
|
||
"versions": [
|
||
{
|
||
"version": "0",
|
||
"status": "affected",
|
||
"lessThanOrEqual": "4.4.1",
|
||
"versionType": "semver"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the `wp_ajax_pos_get_option` AJAX handler, which verifies only a nonce that is localized to every logged-in admin-area user via `admin_enqueue_scripts` — without any capability check — before returning the value of any arbitrary WordPress option via `get_option()`, combined with the `admin_login_endpoint_handler` REST endpoint (`GET /wp-json/epm/v1/admin/login`) being registered as publicly accessible and authenticating callers solely by a whirlpool hash of values stored in those same options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the `site_url`, `connection_key`, and `remote_user_id` values stored in the `eazywp_connecting_info` and `eazywp_connection` options, compute the required `auth_key`, call the `admin/login` REST endpoint to obtain Administrator authentication cookies, and fully take over the site. Exploitation requires the plugin's remote connection feature to have been configured, as the `eazywp_connecting_info` and `eazywp_connection` options must be populated with valid credentials."
|
||
}
|
||
],
|
||
"title": "Eazy Plugin Manager <= 4.4.1 - Authenticated (Subscriber+) Privilege Escalation via pos_get_option AJAX Action and admin/login REST Endpoint",
|
||
"references": [
|
||
{
|
||
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/23a73680-ed13-4250-95e8-2933403f54e6?source=cve"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/plugins-on-steroids/tags/4.4.1/libs/class.rest_api.php#L263"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/plugins-on-steroids/tags/4.4.1/plugins-on-steroids.php#L1153"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/plugins-on-steroids/tags/4.4.1/plugins-on-steroids.php#L1221"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/plugins-on-steroids/tags/4.4.1/plugins-on-steroids.php#L446"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/plugins-on-steroids/tags/4.4.1/libs/class.rest_api.php#L46"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/plugins-on-steroids/tags/4.4.1/libs/class.rest_api.php#L1478"
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"description": "CWE-269 Improper Privilege Management",
|
||
"cweId": "CWE-269",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 8.8,
|
||
"baseSeverity": "HIGH"
|
||
}
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"type": "finder",
|
||
"value": "Nia"
|
||
}
|
||
],
|
||
"timeline": [
|
||
{
|
||
"time": "2026-07-27T21:29:11.000Z",
|
||
"lang": "en",
|
||
"value": "Disclosed"
|
||
}
|
||
]
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2026-07-28T13:59:45.463738Z",
|
||
"id": "CVE-2026-14328",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "total"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-07-28T14:00:19.271Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |