CVE-2026-14444 in Fusion Plugin
Summary
by MITRE • 09/07/2026
The WP Fusion (Pro) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, and who possess the access_key, to create a new user account with administrator privileges and gain full control over the WordPress site. The required access_key is intentionally shared with ThriveCart customers as part of the plugin's documented setup process, making it accessible to attackers who have made a purchase. The vulnerability is only exploitable when the ThriveCart Auto Login option is enabled.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/07/2026
The WP Fusion Pro plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to and including 3.47.13, classified under CWE-269 as Improper Privilege Management. This flaw resides within the ThriveCart Auto Login handler's thrivecart() function, where insufficient authorization checks are performed on the role parameter during user account creation or modification processes. The vulnerability allows authenticated attackers with Subscriber-level access and above to escalate their privileges by manipulating this specific parameter. Because the required access_key is intentionally shared with ThriveCart customers as part of the plugin’s documented setup process, it becomes accessible to any attacker who has purchased a product through ThriveCart that utilizes WP Fusion. This design choice inadvertently lowers the barrier for exploitation, transforming what might otherwise be an obscure internal flaw into a widely exploitable issue among users of the e-commerce platform integration.
From a technical perspective, the core failure lies in the lack of strict validation and authorization checks when processing the role parameter within the thrivecart() function. When the ThriveCart Auto Login option is enabled, the plugin accepts input that determines the user's role without verifying whether the authenticated user has the administrative rights necessary to assign such roles or whether the requested role aligns with standard security policies for new accounts created via external integrations. This allows an attacker to inject a value corresponding to administrator privileges into the request payload. Upon successful processing, the system creates or updates a user account with full control over the WordPress installation, bypassing intended access controls. The exploitability is contingent upon the ThriveCart Auto Login feature being active, which serves as the primary attack vector for this specific privilege escalation path.
The operational impact of this vulnerability is severe, granting attackers complete administrative control over the compromised WordPress site once they successfully escalate their privileges. With administrator-level access, an attacker can execute arbitrary code, modify core files, install malicious plugins or themes, exfiltrate sensitive data from the database, and potentially pivot to other systems within the network infrastructure. This level of compromise undermines the integrity, confidentiality, and availability of the web application and its underlying data assets. The fact that the access_key is publicly available to customers means that any entity with a basic ThriveCart purchase can attempt this attack, significantly expanding the potential threat surface compared to vulnerabilities requiring unique or secret credentials not readily obtainable by casual attackers.
To mitigate this risk, immediate action is required for all organizations running WP Fusion Pro versions up to 3.47.13. The primary remediation step is to upgrade the plugin to a version later than 3.47.13 where the authorization checks on the role parameter have been properly implemented and validated according to secure coding standards. In addition to upgrading, administrators should review their ThriveCart Auto Login settings and consider disabling this feature if it is not strictly necessary for business operations, thereby removing the specific attack vector entirely. Implementing strict input validation and ensuring that privilege assignment functions always verify the current user's permissions against a whitelist of allowed roles can further harden the application against similar future flaws. Monitoring logs for unusual account creation events or role changes associated with ThriveCart endpoints can also aid in early detection of exploitation attempts, aligning with ATT&CK techniques related to Account Manipulation and Privilege Escalation within cloud environments.