CVE-2026-14328
Received Received - Intake

Privilege Escalation in Eazy Plugin Manager WordPress Plugin

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Wordfence

Description
The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the `wp_ajax_pos_get_option` AJAX handler, which verifies only a nonce that is localized to every logged-in admin-area user via `admin_enqueue_scripts` — without any capability check — before returning the value of any arbitrary WordPress option via `get_option()`, combined with the `admin_login_endpoint_handler` REST endpoint (`GET /wp-json/epm/v1/admin/login`) being registered as publicly accessible and authenticating callers solely by a whirlpool hash of values stored in those same options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the `site_url`, `connection_key`, and `remote_user_id` values stored in the `eazywp_connecting_info` and `eazywp_connection` options, compute the required `auth_key`, call the `admin/login` REST endpoint to obtain Administrator authentication cookies, and fully take over the site. Exploitation requires the plugin's remote connection feature to have been configured, as the `eazywp_connecting_info` and `eazywp_connection` options must be populated with valid credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-14328
EUVD
EUVD-2026-49735

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
eazy_plugin_manager eazy_plugin_manager to 4.4.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Eazy Plugin Manager WordPress plugin allows authenticated attackers with Subscriber-level access or higher to escalate privileges and take over a WordPress site. It exploits insufficient authorization checks in the plugin's AJAX handler and a publicly accessible REST endpoint. Attackers can read sensitive options, compute an authentication key, and obtain admin cookies to fully compromise the site.

Detection Guidance

Check if the Eazy Plugin Manager plugin is installed and its version is up to 4.4.1. Look for unauthorized access attempts to the wp_ajax_pos_get_option AJAX handler or the /wp-json/epm/v1/admin/login REST endpoint. Review server logs for suspicious activity involving these endpoints.

Impact Analysis

If you use the Eazy Plugin Manager plugin in WordPress with versions up to 4.4.1, an attacker could gain full control of your website. This includes accessing sensitive data, modifying content, installing malicious plugins, or disrupting site operations. The attack requires only a low-privilege user account and the plugin's remote connection feature to be configured.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. A successful exploit may expose sensitive user data, resulting in legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Immediately update the Eazy Plugin Manager plugin to the latest version beyond 4.4.1. If an update is not available, consider disabling or removing the plugin. Review and restrict user roles to prevent Subscriber-level access from being exploited. Monitor for any signs of unauthorized access or privilege escalation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14328. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart