What is the CVSS score of CVE-2026-14250?

CVE-2026-14250 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Th Login Registration CVE-2026-14250

EUVD-2026-42217 MEDIUM

Improper Privilege Management (CWE-269)

2026-07-08 Wordfence

GHSA-qwpf-8g3r-53wg

WordPress Privilege Escalation Wordpress Plugin Th Login Registration Themehunk

6.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

8.2 HIGH

REST endpoint is explicitly unauthenticated per description (PR:N); editor role grants full site content control (I:H); no direct availability impact from account creation.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 12:46 vuln.today

CVE Published

Jul 08, 2026 - 11:30 nvd

MEDIUM 6.3

DescriptionCVE.org

The Themehunk Login Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.0.2. This is due to the handle_frontend_register() function in the unauthenticated /thlogin/v1/register REST endpoint accepting a user-controlled 'role' parameter and validating it only against get_editable_roles() - which returns every defined editable site role, including 'editor' - before passing it to wp_insert_user(). This makes it possible for unauthenticated attackers, when public user registration is enabled, to create new accounts with the editor role.

AnalysisAI

Privilege escalation in the Themehunk Login Registration WordPress plugin (versions up to and including 1.0.2) allows unauthenticated attackers to self-register accounts with elevated roles - including editor - by supplying an arbitrary 'role' parameter to the publicly exposed /thlogin/v1/register REST endpoint. The handle_frontend_register() function validates the supplied role only against get_editable_roles(), which returns every administratively configurable role on the site, then passes it directly to wp_insert_user() without restricting it to the subscriber level expected for public self-registration. Exploitation is conditioned on public user registration being enabled on the target site; no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The vulnerability exists in the handle_frontend_register() function of the REST API class within the Themehunk Login Registration plugin (CPE: cpe:2.3:a:themehunk:th_login_registration:*:*:*:*:*:*:*:*), registered at the unauthenticated /thlogin/v1/register WordPress REST endpoint. The root cause is CWE-269 (Improper Privilege Management): the plugin uses WordPress core's get_editable_roles() as a role allowlist during registration validation, but this function returns all roles that site administrators can assign - including editor, author, and contributor - rather than only the subscriber role appropriate for self-service account creation. The validated role is then passed directly to wp_insert_user() without any downgrade or restriction. Source code confirming the logic is visible in WordPress SVN at the tagged 1.0.2 release across multiple files in class-thlogin-rest-api.php (lines 82, 243, 782, and 811). The WordPress editor role confers broad site-wide content control: creation, editing, publishing, and deletion of all posts and pages, media uploads, comment moderation, and category management.

RemediationAI

A code change has been committed to the WordPress Plugin SVN repository (changeset 3592690, referenced in the advisory), but no specific patched release version number has been confirmed in the available data - monitor the WordPress Plugin Directory for a version above 1.0.2 and verify its changelog explicitly addresses the role restriction in handle_frontend_register() before upgrading. The single most effective immediate mitigation is to disable public user registration under WordPress Settings > General by unchecking 'Anyone can register'; this eliminates the attack surface entirely since the vulnerability only triggers when registration is open, with no trade-off unless self-registration is a required site feature. If registration must remain enabled, temporarily deactivating the Themehunk Login Registration plugin and reverting to WordPress core registration is a viable interim control. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8eee3809-133e-4fd9-ad49-cc6fe3822457 for patch version confirmation.