Th Login Registration CVE-2026-14250

Exploitation requires that the target WordPress site have public user registration explicitly enabled under Settings > General (the 'Anyone can register' checkbox) - this is disabled by default in WordPress and is the single gating prerequisite; sites without it are not exposed. The Themehunk Login Registration plugin must be installed, active, and at version 1.0.2 or earlier. No attacker authentication is required to invoke the /thlogin/v1/register REST endpoint. The maximum role achievable is bounded by whatever roles get_editable_roles() returns on the specific installation; on a standard WordPress deployment this includes editor, author, contributor, and subscriber, but not administrator (which is excluded from editable roles by default). Exploitation is further limited to sites where the Themehunk plugin's REST endpoint is actually handling registration rather than the WordPress core registration flow.

The provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, score 6.3) contains a direct conflict with the CVE description: PR:L implies low-privilege authentication is required, yet the description explicitly identifies the REST endpoint as unauthenticated and states exploitation requires no prior account. This discrepancy should be verified with NVD or Wordfence before using the published vector for risk decisions. Independently, the impact metrics also appear underrated - gaining WordPress editor access represents substantially more than I:L, as editors can alter all published content site-wide. No EPSS score was provided in the available data, and the vulnerability does not appear in the CISA KEV catalog, so no confirmed active exploitation signal exists. The primary real-world limiting factor is that WordPress public user registration is disabled by default; sites not using self-registration are entirely unaffected. For those that do, the attack is trivially scriptable with a single HTTP POST, making the conditional risk meaningful once the prerequisite is satisfied.

An attacker identifies a WordPress site with the Themehunk Login Registration plugin active and public user registration enabled, then sends a single unauthenticated HTTP POST to /wp-json/thlogin/v1/register with a JSON body including 'role': 'editor' alongside required registration fields. The plugin's get_editable_roles() check permits the value, wp_insert_user() creates the account at editor level, and the attacker immediately logs in to edit, publish, or delete all site content. No public exploit code has been identified at time of analysis, but the attack requires no specialized tooling - a standard HTTP client or browser developer tools suffice.