CVE-2026-14805
Received Received - Intake

Privilege Escalation in Consulting WordPress Theme

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Wordfence

Description
The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: (1) the masterstudy_ms_stm_set_discard_transient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient key without capability checks or nonce validation, and (2) the developer access login mechanism in admin/classes/stm-theme-support.php authenticates users based on a transient value without proper cryptographic validation when in legacy string mode. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the stm_developer_access_token transient to a known value (1), then authenticate as any existing user including administrators by visiting a specially crafted URL, thereby achieving full privilege escalation to administrator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-14805
EUVD
EUVD-2026-78466

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
consulting_theme consulting_theme to 6.7.16 (inc)
consulting theme to 6.7.16 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This WordPress Consulting theme vulnerability allows authenticated attackers with subscriber-level access or higher to escalate privileges to administrator. It exploits two flaws: an AJAX endpoint that accepts arbitrary transient keys without checks and a login mechanism that authenticates users based on a transient value without proper validation. Attackers can set a specific transient value and craft a URL to gain full admin access.

Detection Guidance

To detect this vulnerability, check WordPress sites running the Consulting theme version 6.7.16 or lower. Look for unauthorized admin access attempts or suspicious AJAX requests to the masterstudy_ms_stm_set_discard_transient endpoint. Review server logs for unusual transient modifications or developer access token usage.

Impact Analysis

If you use the Consulting theme for WordPress versions up to 6.7.16, attackers could take over your entire website. They could create new admin accounts, modify content, steal data, install malware, or completely disable your site. Even low-privilege users like subscribers could exploit this to gain full control.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. A breach could result in regulatory fines, legal liabilities, and reputational damage due to compromised personal or health information.

Mitigation Strategies

Update the Consulting theme for WordPress to the latest version beyond 6.7.16 immediately. Remove subscriber-level access or higher for untrusted users until patched. Review user accounts for unauthorized administrator access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14805. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart