What is the CVSS score of CVE-2026-14482?

CVE-2026-14482 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-14482?

Within 24 hours: Identify all WordPress installations running Duoshuo versions ≤1.2 and immediately deactivate and delete the plugin; audit all administrator accounts for unauthorized additions or suspicious access patterns. Within 7 days: Review critical WordPress options (default_role, users_can_register) for unauthorized modifications; scan access logs for POST requests to api.php/LocalServer.php; reset all administrator credentials. Within 30 days: Deploy an alternative commenting system (Disqus, Commento, or native WordPress); implement Web Application Firewall (WAF) rules blocking /api.php endpoint access; document removal in change control system.

Duoshuo Plugin CVE-2026-14482

EUVD-2026-42162 HIGH

Improper Privilege Management (CWE-269)

2026-07-08 Wordfence

GHSA-mc85-hq4f-frgp

WordPress Privilege Escalation Wordpress Plugin

8.8

CVSS 3.1 · Vendor: Wordfence

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Scan for sites running Duoshuo plugin
Delivery

Send crafted request to update_option API
Exploit

Forge HMAC-SHA1 with empty key
Execution

Set default_role=administrator, enable registration
Persist

Register new account via wp-login
Impact

Gain administrator privileges, full site takeover

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires that the target WordPress site has the Duoshuo (多说社会化评论框) plugin version ≤1.2 installed and active, exposing its web-accessible api.php/LocalServer.php `update_option` endpoint to the attacker. The description indicates no authentication and no user interaction are needed against a default plugin install, because the capability and nonce checks are missing and the HMAC-SHA1 signature is forgeable (its key is an always-empty WordPress option). The main limiting factor is deployment: only sites still running this now-obsolete plugin are affected. Full admin-account takeover additionally depends on the attacker being able to reach the registration flow after flipping `default_role`/`users_can_register`, which the same primitive enables.
Impact	Signals are strong but partially conflicting. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) rates it High, yet the description explicitly states the endpoint is reachable by UNAUTHENTICATED attackers - so PR:L appears to understate the risk; a PR:N assessment yields a Critical 9.8. This should be verified with Wordfence, but the description strongly supports no-authentication exploitation. There is no EPSS score, no SSVC decision data, and no KEV listing in the input, and no POC is referenced, so exploitation is not confirmed in the wild. Countervailing the high technical severity is prevalence: Duoshuo's hosted service was discontinued years ago and the plugin is niche, so real-world exposure is limited and any exploitation is likely to be opportunistic mass-scanning of remaining installs rather than targeted. Net: high technical severity and low exploitation complexity make this a real priority for anyone still running the plugin, but the small install base caps aggregate risk.
Exploit ScenarioDerived	An attacker scanning for WordPress sites running Duoshuo sends a crafted HTTP request to the plugin's public API endpoint with a forged HMAC-SHA1 signature (computable because the signing key is an always-empty option), setting `option=default_role`/`value=administrator` and enabling `users_can_register`. They then submit the standard wp-login.php?action=register form to create an account that is automatically granted administrator rights, giving full site takeover. No public POC is referenced in the input, but the attack is trivially reconstructable from the disclosed source lines.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 08, 2026

Privilege escalation in the Duoshuo (多说社会化评论框) social commenting plugin for WordPress (all versions through 1.2) lets remote attackers seize full administrator control. An unauthenticated, web-accessible API endpoint (api.php/LocalServer.php) exposes an update_option handler that lacks capability and nonce checks and relies on a trivially forgeable HMAC-SHA1 signature keyed on an always-empty option, allowing attackers to overwrite any WordPress option - for example flipping default_role to administrator and enabling open registration, then self-registering an admin account. No public exploit is identified at time of analysis, and it is not in CISA KEV, but the flaw is straightforward to weaponize.

RemediationAI

No vendor-released patch version is identified in the available data, and the Duoshuo plugin appears unmaintained, so the primary recommendation is to deactivate and fully remove (uninstall) the plugin rather than wait for a fix - its backing Duoshuo service is defunct, so removal has minimal functional cost. If removal is not immediately possible, block external access to the plugin's API endpoints (the api.php / LocalServer.php handlers) at the web server or WAF layer and deny requests carrying the update_option action, accepting that this breaks any remaining plugin callbacks. As a compensating control, force users_can_register to off and pin default_role to subscriber (and monitor these options for unexpected changes), and audit existing users for unexpected administrator accounts and recent open-registration activity, since a successful exploit creates a real admin. Consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/732c7ccd-de50-4e27-8cb9-3bb0ed30f0b4?source=cve) for updated guidance.

Affected VersionsENISA

多说社会化评论框 0 ≤1.2

Affected Packages

euvd 多说社会化评论框 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is the WordPress Duoshuo plugin (vendor 'shen2', CPE cpe:2.3:a:shen2:多说社会化评论框), a Chinese social-comment integration. The root cause is CWE-269 (Improper Privilege Management): the plugin registers a directly reachable HTTP API (see plugins.trac.wordpress.org duoshuo/tags/1.2/api.php#L40 and LocalServer.php#L49/#L54) whose update_option action passes caller-supplied option and value parameters straight into WordPress core's update_option() with no allowlist, sanitization, capability check, or nonce. The only gate is an HMAC-SHA1 signature, but it is keyed on a WordPress option that is always empty in practice, so the shared secret is effectively the empty string and any attacker can compute a valid signature. This turns a generic option-writer into an unauthenticated arbitrary-configuration primitive against WordPress's core settings.

Know when Wordpress Plugin gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Wordfence) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.8 CRITICAL

Description states unauthenticated web-accessible endpoint with forgeable signature, so PR:N (not the input's PR:L) and AC:L; option overwrite yields full admin takeover, so C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

The 多说社会化评论框 plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. The vulnerability exists due to a missing capability and nonce check on a directly web-accessible API endpoint, combined with a trivially forgeable HMAC-SHA1 signature keyed on an always-empty WordPress option, which allows the endpoint's update_option handler to pass attacker-controlled option and value parameters directly to WordPress's update_option function without any allowlist or sanitization. This makes it possible for unauthenticated attackers to update arbitrary WordPress options - such as setting default_role to administrator and enabling open registration - and subsequently register an account with full administrator privileges.

Executive ViewAI

Why It Matters

Duoshuo, a WordPress commenting plugin installed on potentially thousands of sites, contains a critical privilege escalation vulnerability allowing unauthenticated internet users to assume full administrative control over affected WordPress installations. While no public exploit has been identified at time of analysis, the vulnerability is straightforward to exploit, and attackers could create administrator accounts, inject malware, and modify content. The vendor has released no patch as of this analysis, requiring immediate mitigation.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations if plugin removal is delayed: (1) Immediately remove the plugin-this is the only fully effective control; (2) Disable web access to wp-content/plugins/duoshuo/api.php via web server configuration (.htaccess or nginx); (3) Block all requests to /api.php endpoints at WAF level; (4) Set users_can_register to false and default_role to subscriber; (5) Monitor access logs for POST requests containing update_option parameters and establish alerting.

Threat Intelligence Overview

EPSS Score

0.3%

Top 76% exploitable

Prevalence

Low

niche Chinese WordPress plugin; backing Duoshuo service discontinued

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.