CVE-2026-14805 in Consulting Plugin
Summary
by MITRE • 09/15/2026
The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: (1) the masterstudy_ms_stm_set_discard_transient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient key without capability checks or nonce validation, and (2) the developer access login mechanism in admin/classes/stm-theme-support.php authenticates users based on a transient value without proper cryptographic validation when in legacy string mode. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the stm_developer_access_token transient to a known value (1), then authenticate as any existing user including administrators by visiting a specially crafted URL, thereby achieving full privilege escalation to administrator.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The Consulting theme for WordPress, specifically in versions up to and including 6.7.16, contains critical security vulnerabilities that allow authenticated attackers with subscriber-level access or higher to escalate their privileges to those of an administrator. This severe flaw stems from a combination of two distinct technical deficiencies within the plugin's administrative handling mechanisms. The first vulnerability resides in the masterstudy_ms_stm_set_discard_transient AJAX endpoint located in admin/admin-notices/classes/STMHandler.php. This endpoint is designed to manage transient data but fails to implement essential security controls such as capability checks or nonce validation. Consequently, any authenticated user can invoke this endpoint and set an arbitrary transient key without restriction. The second vulnerability involves the developer access login mechanism found in admin/classes/stm-theme-support.php. This authentication process relies on a specific transient value for verification purposes but lacks proper cryptographic validation when operating in legacy string mode. By combining these two flaws, an attacker can first manipulate the system state by setting the stm_developer_access_token transient to a known, predetermined value using the unrestricted AJAX endpoint. Subsequently, the attacker can visit a specially crafted URL that triggers the developer access login mechanism, which will accept this manipulated token as valid authentication credentials. This sequence allows the attacker to impersonate any existing user on the site, including high-privilege administrators, thereby achieving full control over the WordPress installation.
From a technical perspective, these vulnerabilities represent classic examples of insecure direct object references and broken access control mechanisms. The failure to validate nonces or check capabilities in the AJAX handler aligns with CWE-352, which describes Cross-Site Request Forgery (CSRF) due to missing CSRF tokens, although here it is compounded by a lack of authorization checks that falls under CWE-862, Missing Authorization. Furthermore, the reliance on transient values for authentication without cryptographic integrity verification relates closely to CWE-347, Improper Verification of Cryptographic Signature, as the system trusts data that has not been securely signed or encrypted. In terms of offensive security frameworks, this attack vector maps directly to MITRE ATT&CK technique T1078, Valid Accounts, specifically the sub-technique for Privilege Escalation via account manipulation. The attacker leverages valid credentials at a low privilege level to gain unauthorized access to higher-level functions and data, which is characteristic of lateral movement or escalation tactics observed in advanced persistent threats targeting web applications.
The operational impact of this vulnerability is profound, as it effectively nullifies the security boundary between regular users and site administrators on affected WordPress installations. An attacker with even minimal subscriber-level access can take complete control of the website. This level of compromise allows for a wide range of malicious activities, including but not limited to defacing the public-facing content, injecting malware or backdoors into theme files, exfiltrating sensitive user data such as email addresses and hashed passwords, and installing additional plugins that may persist beyond the initial exploitation. Since WordPress sites often serve as the backbone for business operations, e-commerce platforms, or personal blogs, this privilege escalation can lead to significant financial loss, reputational damage, and compliance violations depending on the nature of the stored data. The ease of exploitation means that automated scanners targeting common WordPress vulnerabilities could easily identify and exploit this flaw across thousands of sites running outdated versions of the theme.
To mitigate these risks, immediate action is required by site administrators and developers. The primary recommendation is to update the Consulting theme to a version later than 6.7.16 where these flaws have been addressed with proper nonce validation, capability checks, and secure cryptographic handling for authentication tokens. If updating is not immediately feasible, temporary mitigations should be implemented at the web server or application firewall level to restrict access to the identified AJAX endpoints unless they originate from trusted administrative contexts. Additionally, enforcing strong password policies and multi-factor authentication can reduce the risk of initial account compromise that often precedes such privilege escalation attacks. Developers reviewing similar code patterns in other plugins or themes should ensure that all AJAX handlers include strict capability verification using functions like current_user_can() and validate nonces with wp_verify_nonce(). Authentication mechanisms must never rely on predictable or easily manipulatable transient values without additional cryptographic safeguards to prevent impersonation attacks.