Privilege Escalation Vulnerability in Eazy Plugin Manager for WordPress

CVE-2026-14328

What is CVE-2026-14328?

The Eazy Plugin Manager for WordPress suffers from a privilege escalation issue that allows authenticated attackers to exploit insufficient authorization in the wp_ajax_pos_get_option AJAX handler. The vulnerability arises as this handler relies solely on a nonce localized to each logged-in admin without validating user capabilities. As a result, attackers with Subscriber-level access or higher can access sensitive site information stored in options such as site_url and connection_key by exploiting the publicly accessible REST endpoint. This enables them to compute the necessary auth_key, effectively gaining Administrator authentication and potentially taking full control of the WordPress site. Successful exploitation hinges on the configuration of the plugin's remote connection features, as specific options must contain valid credentials.

References