CVE-2026-14596 in DynamicKit Plugin
Summary
by MITRE • 08/01/2026
The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an attacker-controlled host and carries a valid reset key, leading to account takeover when the victim clicks it.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability in DynamicKit for Elementor WordPress plugin prior to version 1.0.3 represents a critical security flaw that enables unauthenticated attackers to execute account takeover attacks through manipulated password reset emails. This issue stems from insufficient validation of user-supplied URLs within the plugin's password reset functionality, creating a pathway for malicious actors to redirect legitimate reset links to attacker-controlled domains. The vulnerability specifically affects the host validation mechanism that should ensure reset links point to the legitimate website domain rather than arbitrary external hosts.
The technical implementation flaw occurs when the plugin generates password reset emails containing URLs with valid reset tokens but redirects the base host to an attacker-controlled domain. This allows attackers to craft convincing reset emails that appear to originate from the target website, leveraging the legitimate email format and valid reset key to bypass normal security checks. The vulnerability operates at the application layer and can be exploited through social engineering tactics where victims are tricked into clicking malicious reset links. According to CWE classification, this represents a weakness in input validation and improper neutralization of special elements used in URLs, specifically CWE-170 for improper handling of input with special characters that could enable path traversal or host redirection.
The operational impact of this vulnerability is severe as it enables complete account takeover without requiring authentication or knowledge of user credentials. An attacker can generate a password reset email and send it to any target user, knowing that the reset link will contain a valid reset token but point to an attacker-controlled domain. When the victim clicks the link, they are redirected to the attacker's server where they can set a new password, effectively gaining unauthorized access to the compromised account. This attack vector aligns with ATT&CK technique T1566 for phishing and T1078 for valid accounts, as it leverages legitimate reset functionality to compromise user accounts.
Mitigation strategies include immediate patching of the DynamicKit plugin to version 1.0.3 or later, which implements proper host validation for reset URLs. Administrators should also implement additional security measures such as monitoring email logs for unusual reset requests and implementing email authentication protocols like SPF, DKIM, and DMARC to prevent spoofing. Network-level protections including web application firewalls can help detect and block malicious URL patterns. Organizations should conduct regular security assessments of installed plugins and maintain updated security patches. The vulnerability highlights the importance of proper input validation and output encoding in web applications, particularly when handling user-supplied data that may be used in URL construction or redirection. Regular security audits and penetration testing can help identify similar validation weaknesses in other components of the WordPress ecosystem.