EUVD-2026-49735
GHSA-8fxc-wrxg-769w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (wordfence) · only source for this CVE.
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Eazy Plugin Manager - Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the wp_ajax_pos_get_option AJAX handler, which verifies only a nonce that is localized to every logged-in admin-area user via admin_enqueue_scripts - without any capability check - before returning the value of any arbitrary WordPress option via get_option(), combined with the admin_login_endpoint_handler REST endpoint (GET /wp-json/epm/v1/admin/login) being registered as publicly accessible and authenticating callers solely by a whirlpool hash of values stored in those same options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the site_url, connection_key, and remote_user_id values stored in the eazywp_connecting_info and eazywp_connection options, compute the required auth_key, call the admin/login REST endpoint to obtain Administrator authentication cookies, and fully take over the site. Exploitation requires the plugin's remote connection feature to have been configured, as the eazywp_connecting_info and eazywp_connection options must be populated with valid credentials.
Articles & Coverage 1
AnalysisAI
We are tasked with synthesizing data about CVE-2026-14328 into a comprehensive analysis. The user provided a description, CVSS, CWE, tags, references, and multi-source intelligence note. Our output must be a JSON object with specific fields. Let's go step by step.
First, I need to extract product name. The CVE is about "Eazy Plugin Manager - Powerful Plugin Management Solution for WordPress plugin for WordPress". That's a complex name. The product_name should be 1-3 words, specific. The plugin is called "Eazy Plugin Manager" (maybe the slug is "plugins-on-steroids"? from references, the plugin folder is "plugins-on-steroids", but the description says "Eazy Plugin Manager - Powerful Plugin Management Solution for WordPress". So the product is the Eazy Plugin Manager WordPress plugin. I'll use "Eazy Plugin Manager" as the product name. Confirm: references show paths like "plugins.trac.wordpress.org/browser/plugins-on-steroids/tags/4.4.1/...", so the plugin slug is "plugins-on-steroids" but the marketed name is "Eazy Plugin Manager". For product_name, use "Eazy Plugin Manager" (or "Eazy Plugin Manager for WordPress"? The requirement says 1-3 words, so likely "Eazy Plugin Manager". I'll use "Eazy Plugin Manager".
Summary: Must not copy description, but original synthesis. Include impact, affected product, attacker capabilities. Mention if actively exploited, POC, EPSS. Input doesn't have KEV status or EPSS score explicitly. The user didn't provide EPSS or KEV. The description says "authenticated attackers, with Subscriber-level access and above". That's PR:L per CVSS vector (PR:L). So it requires a low-privileged user. No mention of exploitation in the wild, no KEV. POC? Not explicitly, but maybe from Wordfence advisory they might have details. The references are code links and the Wordfence threat intel page. I can't assume POC exists unless stated. The input just says "Tags: WordPress, Privilege Escalation". So I'll state "no public exploit identified at time of ana
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today