CVE-2026-14444: 
WordPress vulnerability analysis and mitigation

CVE-2026-14444 is a Privilege Escalation vulnerability in the WP Fusion (Pro) plugin for WordPress, affecting all versions up to and including 3.47.13. The flaw stems from insufficient authorization checks on the role parameter within the ThriveCart Auto Login handler's thrivecart() function, allowing authenticated attackers to create administrator-level accounts. It was published on September 7, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Wordfence).

The vulnerability is classified as CWE-269 (Improper Privilege Management). The thrivecart() function in the ThriveCart Auto Login handler fails to validate or restrict the role parameter supplied in requests, allowing an attacker to specify administrator as the desired role when creating a new user account. Exploitation requires two preconditions: the attacker must be authenticated with at least Subscriber-level access, and must possess the plugin's access_key — a credential intentionally distributed to ThriveCart customers as part of the documented integration setup, making it broadly accessible to anyone who has made a ThriveCart purchase. The vulnerability is only exploitable when the ThriveCart Auto Login option is enabled in the plugin settings (GitHub Advisory, Wordfence).

Successful exploitation grants an attacker full administrative control over the affected WordPress site, enabling them to install malicious plugins, modify site content, exfiltrate sensitive data (including user credentials and personal information), and potentially pivot to the underlying server infrastructure. The confidentiality, integrity, and availability impacts are all rated High, as a rogue administrator account can perform any action within the WordPress environment (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Wordfence). The CVE status is listed as "Deferred" and the NVD SSVC assessment confirms exploitation is currently "none" and the attack is not automatable. The EPSS score is approximately 0.214% (12th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Acquire the access_key: Obtain the WP Fusion ThriveCart integration access_key by making a purchase through ThriveCart on a site using the plugin, or by obtaining it through other means (e.g., social engineering, prior access to the site's WP Fusion settings).
2. Verify preconditions: Confirm the target WordPress site has WP Fusion (Pro) ≤ 3.47.13 installed and that the ThriveCart Auto Login option is enabled in the plugin configuration.
3. Authenticate to the site: Log in to the WordPress site with at least a Subscriber-level account, or leverage the access_key in an unauthenticated request to the ThriveCart Auto Login endpoint (depending on exact implementation).
4. Craft a malicious request: Send a crafted HTTP request to the ThriveCart Auto Login handler endpoint, supplying the access_key and setting the role parameter to administrator along with new user account details (username, email, password).
5. Gain administrator access: The plugin creates a new WordPress user account with administrator privileges due to the missing role validation. Log in with the newly created administrator account to achieve full site control (GitHub Advisory, Wordfence).

• Logs: WordPress authentication logs showing new administrator account creation events, particularly accounts created via the ThriveCart Auto Login handler; unexpected entries in wp_users and wp_usermeta tables with wp_capabilities set to administrator.
• File System: Unexpected new plugins or theme file modifications made shortly after a new administrator account was created.
• Network: HTTP POST requests to the WP Fusion ThriveCart Auto Login endpoint (typically a WordPress REST API or admin-ajax endpoint) containing a role=administrator parameter and an access_key value.
• WordPress Admin: Presence of unfamiliar administrator accounts in the WordPress Users dashboard, especially accounts with no prior activity history or created at unusual times.

Update the WP Fusion (Pro) plugin to a version later than 3.47.13, which contains the fix for this vulnerability (WP Fusion Changelog). As an interim workaround, disable the ThriveCart Auto Login option in the WP Fusion plugin settings to eliminate the attack surface entirely. Additionally, audit existing WordPress administrator accounts for any unauthorized entries, restrict access_key distribution to trusted parties only, and consider rotating the access_key if it may have been exposed (Wordfence).

The vulnerability was reported and assigned by Wordfence, which published a threat intelligence entry for it. RedPacketSecurity noted the vulnerability on Mastodon shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the initial advisory has been identified at this time (Wordfence).