MultiSocialReviewPlugin up to 1.2 Directly Web-Accessible API Endpoint option/value weak password hash

Summaryinfo

A vulnerability classified as problematic was found in MultiSocialReviewPlugin up to 1.2. The impacted element is an unknown function of the component Directly Web-Accessible API Endpoint. Executing a manipulation of the argument option/value can lead to weak password hash. This vulnerability appears as CVE-2026-14482. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic was found in MultiSocialReviewPlugin up to 1.2 (WordPress Plugin). This vulnerability affects an unknown function of the component Directly Web-Accessible API Endpoint. The manipulation of the argument option/value with an unknown input leads to a weak password hash vulnerability. The CWE definition for the vulnerability is CWE-916. The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive. As an impact it is known to affect confidentiality. CVE summarizes:

The 多说社会化评论框 plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. The vulnerability exists due to a missing capability and nonce check on a directly web-accessible API endpoint, combined with a trivially forgeable HMAC-SHA1 signature keyed on an always-empty WordPress option, which allows the endpoint's `update_option` handler to pass attacker-controlled `option` and `value` parameters directly to WordPress's `update_option` function without any allowlist or sanitization. This makes it possible for unauthenticated attackers to update arbitrary WordPress options — such as setting `default_role` to `administrator` and enabling open registration — and subsequently register an account with full administrator privileges.

The advisory is shared for download at wordfence.com. This vulnerability was named CVE-2026-14482 since 07/02/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1552.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-42162). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• WordPress Plugin

Name

• MultiSocialReviewPlugin

Version

• 1.0
• 1.1
• 1.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion