CVE-2026-14328 in Eazy Plugin Manager Plugin
Summary
by MITRE • 07/28/2026
The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the `wp_ajax_pos_get_option` AJAX handler, which verifies only a nonce that is localized to every logged-in admin-area user via `admin_enqueue_scripts` — without any capability check — before returning the value of any arbitrary WordPress option via `get_option()`, combined with the `admin_login_endpoint_handler` REST endpoint (`GET /wp-json/epm/v1/admin/login`) being registered as publicly accessible and authenticating callers solely by a whirlpool hash of values stored in those same options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the `site_url`, `connection_key`, and `remote_user_id` values stored in the `eazywp_connecting_info` and `eazywp_connection` options, compute the required `auth_key`, call the `admin/login` REST endpoint to obtain Administrator authentication cookies, and fully take over the site. Exploitation requires the plugin's remote connection feature to have been configured, as the `eazywp_connecting_info` and `eazywp_connection` options must be populated with valid credentials.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The Eazy Plugin Manager vulnerability represents a critical privilege escalation flaw affecting WordPress installations where the plugin fails to properly validate user capabilities before processing sensitive administrative requests. This weakness exists within the wp_ajax_pos_get_option AJAX handler which relies solely on nonce verification without implementing proper capability checks, creating an avenue for attackers to bypass authorization mechanisms and access arbitrary WordPress options through the get_option() function call. The vulnerability architecture demonstrates a dangerous combination of insufficient input validation and weak authentication flows that collectively enable unauthorized privilege elevation.
The technical exploitation pathway begins with the publicly accessible admin_login_endpoint_handler REST endpoint which accepts authentication requests based solely on whirlpool hash verification of values stored in WordPress options. This design flaw allows attackers to leverage the nonce-based authorization mechanism that is intended for administrative users but lacks proper capability validation, enabling any authenticated user with subscriber-level access or higher to extract sensitive configuration data from eazywp_connecting_info and eazywp_connection options. The vulnerability specifically targets the site_url, connection_key, and remote_user_id values which together provide sufficient information to compute the required auth_key for authentication purposes.
Security researchers analyzing this vulnerability can reference CWE-285 for the insufficient authorization issue and CWE-306 for the missing authentication checks in the REST endpoint implementation. The attack vector aligns with ATT&CK technique T1078.004 which covers valid accounts used for unauthorized access, while also demonstrating elements of T1566 related to credential access through application vulnerabilities. This privilege escalation vulnerability directly impacts the principle of least privilege and demonstrates how improper authorization checks can enable attackers to elevate their privileges from subscriber level to administrator status.
The operational impact of this vulnerability extends beyond simple data theft as it enables full site takeover capabilities, allowing attackers to modify plugin configurations, access sensitive user data, install malicious code, and potentially use the compromised site as a launchpad for further attacks within the network. The requirement for the remote connection feature to be configured creates a false sense of security among administrators who may not realize that simply enabling this functionality exposes their systems to such critical vulnerabilities. Organizations must understand that the absence of proper capability validation in AJAX handlers and REST endpoints creates persistent attack surfaces that can be exploited by attackers with minimal privileges.
Mitigation strategies should prioritize immediate plugin updates to versions addressing this vulnerability, but administrators should also implement network-level restrictions to prevent unauthorized access to REST endpoints, consider disabling unnecessary remote connection features, and establish monitoring for suspicious authentication patterns. The vulnerability highlights the importance of comprehensive authorization checks in all user-facing interfaces and demonstrates how seemingly minor implementation gaps can create severe security consequences that require immediate attention from security teams responsible for WordPress site maintenance and protection.