User Authentication Vulnerability in DynamicKit for Elementor Plugin
CVE-2026-14596
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 1 August 2026
Badges
What is CVE-2026-14596?
The DynamicKit for Elementor plugin prior to version 1.0.3 has a security flaw that fails to validate the host in user-supplied URLs used for password-reset links. This oversight allows attackers to craft a phishing email that appears legitimate, enabling them to send a password reset request linked to a domain they control. When the target user unwittingly clicks the link, they are directed to the attacker's site with a valid reset key, potentially leading to unauthorized access and account takeover. It is crucial for users to update to the latest version to mitigate this risk.
Affected Version(s)
DynamicKit for Elementor 0 < 1.0.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.