CVE-2026-14356
Received Received - Intake

Authorization Bypass in FleekDash V2 WordPress Plugin

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: Wordfence

Description
The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the email address and password of any WordPress user, including administrators, enabling full account takeover and complete site compromise. The public /wp-json/fleekdash/v1/register endpoint auto-provisions a Subscriber-role account and returns a valid REST nonce regardless of the site's users_can_register setting, enabling unauthenticated attackers to self-provision the required credentials and nonce in a single prior request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-08-19
AI Q&A
2026-07-30
EPSS Evaluated
2026-08-18
NVD
CVE-2026-14356
EUVD
EUVD-2026-50966

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
fleekdash fleekdash_v2 to 2.6.2.2 (inc)
fleekdash fleekdash to 2.6.2.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The FleekDash V2 WordPress plugin up to version 2.6.2.2 has an authorization bypass flaw. It fails to verify user permissions before allowing actions. This lets authenticated attackers with subscriber access or higher change any user's email and password, including admin accounts, leading to full site takeover.

Detection Guidance

Check for unauthorized user creation or privilege escalation in WordPress. Inspect logs for POST requests to /wp-json/fleekdash/v1/register. Verify if unknown subscribers exist with admin privileges.

Impact Analysis

Attackers can take over any WordPress account, including admin accounts, by changing passwords and emails. This allows full control of the website. Even unauthenticated users can create subscriber accounts and exploit the flaw if user registration is enabled.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. Full site compromise may result in exposure of sensitive user data, triggering compliance violations and legal penalties.

Mitigation Strategies

Update the FleekDash V2 plugin to the latest version. Disable the plugin if an update is unavailable. Review user accounts for unauthorized changes and revoke suspicious access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14356. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart