CVE-2026-14250: Themehunk Login Registration Plugin Editor Privilege Escalation

Technical summary

CVE-2026-14250 is a privilege escalation vulnerability in the Themehunk Login Registration plugin affecting versions up to 1.0.2. The unauthenticated REST endpoint /thlogin/v1/register() contains a handle_frontend_register() function that accepts a user-controlled 'role' parameter. The function validates this parameter only against get_editable_roles(), which returns all defined editable site roles including 'editor' and 'administrator'. Without additional authorization checks, this role value is passed directly to wp_insert_user(), allowing account creation with arbitrary editable roles. The vulnerability is classified under CWE-269 (Improper Access Control) and requires public user registration to be enabled on the target site.

Business impact

Organizations using this plugin face significant risk if public registration is active. Attackers can bypass normal account creation workflows and immediately gain editor access, enabling them to modify published content, inject malicious code into pages, alter site settings, create backdoor accounts, or damage reputation and user trust. The speed and ease of exploitation mean an attacker could establish persistence within minutes of discovery, making detection and remediation urgent.

Affected systems

Themehunk Login Registration plugin versions up to and including 1.0.2 are vulnerable. The attack vector requires that public user registration be enabled on the WordPress site. Any WordPress installation running an affected version with open registration is at risk, regardless of other security measures, as the endpoint bypasses standard WordPress user role controls.

Exploitability

This vulnerability is highly exploitable. It requires no authentication, no user interaction, and a simple HTTP request to trigger. The only prerequisite is that the site administrator has enabled public user registration—a common configuration for community-driven or membership sites. The attack complexity is minimal and the endpoint is directly exposed via REST API without additional authentication layers. Exploitation can be automated and scaled across multiple targets.

Remediation

Upgrade the Themehunk Login Registration plugin to a patched version released after 1.0.2. Verify the specific version number against the vendor advisory. As an interim mitigation, disable public user registration if it is not operationally required, or restrict REST API access to authenticated users through web application firewall rules or htaccess directives. Review user accounts created since deployment for any unexpected editor or administrator accounts and remove them.

Patch guidance

Contact Themehunk or check their plugin repository for versions released after 1.0.2 that address this privilege escalation. Apply the patch as soon as it becomes available. Verify the update in a staging environment first to ensure compatibility with your site configuration. After patching, audit all user accounts and reset any credentials that may have been compromised during the vulnerability window.

Detection guidance

Monitor WordPress user registration logs and audit trails for accounts created via the /thlogin/v1/register REST endpoint. Search for any user creation events that assigned editor, administrator, or other elevated roles to newly registered accounts, which would be anomalous. Enable REST API logging if available. Review wp-admin access logs for newly created accounts accessing sensitive settings or content management areas. Check server logs for POST requests to /wp-json/thlogin/v1/register with unusual role parameters in the request body.

Why prioritize this

This vulnerability should be prioritized immediately if public registration is enabled on any WordPress site running the affected plugin. The combination of unauthenticated access, low complexity, and high-privilege outcome (editor role) makes it a critical remediation target. Even though the CVSS score of 6.3 (Medium) reflects the requirement for public registration to be enabled, the practical impact when that condition exists is severe. Sites should patch or disable public registration without delay.

Risk score, explained

The CVSS 3.1 score of 6.3 (Medium severity) reflects a network-accessible, low-complexity attack requiring privileges (PR:L) and resulting in low confidentiality, integrity, and availability impact. However, this scoring assumes the account created is a regular user; in reality, the attacker gains editor role, which substantially increases practical impact. The Medium rating may understate risk for sites where editor access directly enables critical operations. Consider this a High priority if public registration is active.

Frequently asked questions