CVE-2026-14328

This CVE (CVSS 8.8) exposes a WordPress plugin that built its own authentication layer completely outside WordPress's capability system — and it shows exactly why that's dangerous. The plugin uses two authentication mechanisms: an AJAX handler that trusts any nonce delivered to an authenticated admin session, and a REST endpoint that accepts whirlpool hashes of stored configuration options as credentials. Neither mechanism calls `current_user_can()`. That's the core flaw: the developer conflated authentication (proving a request came from a logged-in user) with authorization (verifying that user has permission for the specific action). A nonce proves the former; it never guaranteed the latter. The whirlpool hash authentication is particularly insidious. The credentials aren't truly secret — they're derived from values stored in the WordPress options table, readable through the same plugin's AJAX handler. This is security through obscure derivation, not security through secrecy. What makes this exploitable in practice: the remote connection feature must be 'configured' for the vulnerability to trigger, meaning those options must be populated. But here's the catch that most defenders miss — there's no evidence the plugin sanitizes these options when the feature is disabled. If an administrator configured the remote connection, tested it, and then abandoned or deactivated the feature, those credentials may persist in the database while the operator believes the attack surface is gone. The vulnerability remains live in a state the operator thinks is inert. Check your deployments: search for `eazywp_connecting_info` and `eazywp_connection` in your wp_options table. If they exist and contain values, the plugin is vulnerable regardless of whether the feature is currently "active." The fix requires adding `current_user_can('manage_options')` checks to both the AJAX handler and REST endpoint — but verify the patch actually removes the custom hash authentication rather than just adding the capability check on top of it.

Reviewed through automated stages and approved by a human before publication.