CVE-2026-14444— WP Fusion (Pro) <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter
Quick assessment
Affected
Very Good Plugins WP Fusion (Pro)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 WP Fusion（Pro）插件在所有版本（包括 3.47.13 及之前）中存在权限提升漏洞。该漏洞源于 ThriveCart 自动登录处理程序中的 函数对 参数的授权检查不足。 这使得拥有“订阅者（Subscriber）”及以上权限的已认证攻击者，在持有 的情况下，能够创建一个具有管理员权限的新用户账户，从而完全掌控该 WordPress 站点。所需的 在插件文档记载的设置流程中会主动共享给 ThriveCart 客户，因此对于曾进行过购买操作的攻击者而言是可见的。该漏洞仅在启用了“Thr
Possible ATT&CK Techniques 1 AI
T1098.001 · Additional Cloud CredentialsAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Very Good Plugins | WP Fusion (Pro) | ≤ 3.47.13 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-14444
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WP Fusion (Pro) <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The WP Fusion (Pro) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, and who possess the access_key, to create a new user account with administrator privileges and gain full control over the WordPress site. The required access_key is intentionally shared with ThriveCart customers as part of the plugin's documented setup process, making it accessible to attackers who have made a purchase. The vulnerability is only exploitable when the ThriveCart Auto Login option is enabled.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Very Good Plugins | WP Fusion (Pro) | 0 ~ 3.47.13 | - |
|
II. Public POCs for CVE-2026-14444
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14444
请登录查看更多情报信息。
Vendor Pages for CVE-2026-14444 (1)
Other References for CVE-2026-14444 (1)
IV. Related Vulnerabilities
V. Comments for CVE-2026-14444
No comments yet