CVE-2026-14805

The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: (1) the masterstudy_ms_stm_set_discard_transient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient key without capability checks or nonce validation, and (2) the developer access login mechanism in admin/classes/stm-theme-support.php authenticates users based on a transient value without proper cryptographic validation when in legacy string mode. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the stm_developer_access_token transient to a known value (1), then authenticate as any existing user including administrators by visiting a specially crafted URL, thereby achieving full privilege escalation to administrator.

• CWE-269

• https://themeforest.net/item/consulting-business-finance-wordpress-theme/14740561#item-description__changelog
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bc8dffc2-ae5b-4482-9eba-adc439a52c26?source=cve

Published

Sep 15, 2026

Last Modified

Sep 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1480An out-of-band SQL injection vulnerability (OOB SQLi) has be…7.5
• CVE-2026-14800A weakness has been identified in imhamzaazam ecommerceFlask…4.3
• CVE-2026-14801A security vulnerability has been detected in GPAC 26.03-DEV…4.8
• CVE-2026-14802A vulnerability was detected in react create-react-app up to…7.3
• CVE-2026-14803Mojo::JSON versions before 9.47 for Perl allow memory exhaus…6.5
• CVE-2026-14804Use of hard-coded cryptographic key vulnerability in Bilin S…9.1
• CVE-2026-14807ERP App developed by PROG MIS has a Use of Hard-coded Creden…9.8
• CVE-2026-14808Prog Management System developed by PROG MIS has a Exposur…9.8
• CVE-2026-14809Prog Management System developed by PROG MIS has a SQL Injec…8.7
• CVE-2026-1481An out-of-band SQL injection vulnerability (OOB SQLi) has be…7.5
• CVE-2026-14812The Premium SEO WordPress plugin is malicious: it ships an u…10
• CVE-2026-14816The GDPR Framework By Data443 WordPress plugin before 2.4.0 …6.5