CVE-2026-14356

The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the email address and password of any WordPress user, including administrators, enabling full account takeover and complete site compromise. The public /wp-json/fleekdash/v1/register endpoint auto-provisions a Subscriber-role account and returns a valid REST nonce regardless of the site's users_can_register setting, enabling unauthenticated attackers to self-provision the required credentials and nonce in a single prior request.

• CWE-862

• https://plugins.trac.wordpress.org/browser/fleekdash/trunk/includes/Controllers/UserController.php#L413
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0867f6a6-17f6-48d3-8ef2-bf89f5b28b05?source=cve

Published

Jul 30, 2026

Last Modified

Jul 30, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-14345The WPFunnels – Funnel Builder for WooCommerce with Checkout…9.8
• CVE-2026-1435Not properly invalidated session vulnerability in Graylog We…9.8
• CVE-2026-14351GitLab has remediated an issue in GitLab CE/EE affecting all…4.3
• CVE-2026-14352The AR for WooCommerce plugin for WordPress is vulnerable to…7.5
• CVE-2026-14354CWE-522 Insufficiently Protected Credentials vulnerability e…8.7
• CVE-2026-14355In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.…5.3
• CVE-2026-14358Improper neutralization of input during web page generation …6.1
• CVE-2026-1436Improper Access Control (IDOR) in the Graylog API, version 2…6.5
• CVE-2026-14361The consul-template library before version 0.42.1 is vulnera…4.7
• CVE-2026-14362HashiCorp memberlist before version 0.6.0 is vulnerable to a…4.9
• CVE-2026-14363Improper neutralization of special elements used in an SQL c…9.8
• CVE-2026-14364The TrueBooker – Appointment Booking and Scheduler System pl…9.8