CVE-2026-14356 Details
Description
The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the email address and password of any WordPress user, including administrators, enabling full account takeover and complete site compromise. The public /wp-json/fleekdash/v1/register endpoint auto-provisions a Subscriber-role account and returns a valid REST nonce regardless of the site's users_can_register setting, enabling unauthenticated attackers to self-provision the required credentials and nonce in a single prior request.
A vulnerability exists in the FleekDash V2 plugin for WordPress, in all versions through 2.6.2.2, allowing authorization bypass. The plugin fails to properly verify user authorization for actions, enabling authenticated attackers with subscriber-level access or higher to overwrite the email addresses and passwords of any WordPress users, including administrators. This flaw facilitates full account takeover and complete site compromise. Additionally, the public /wp-json/fleekdash/v1/register endpoint automatically creates a Subscriber account and issues a valid REST nonce, regardless of the site's user registration settings. This behavior allows unauthenticated attackers to obtain the necessary credentials and nonce in a single request.
Users are advised to update the FleekDash V2 plugin to version 2.6.2.5 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://plugins.trac.wordpress.org/browser/fleekdash/trunk/includes/Controllers/UserController.php#L413 | [email protected] | Broken LinkSource CodeVendor |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/0867f6a6-17f6-48d3-8ef2-bf89f5b28b05?source=cve | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FleekDash | <= 2.6.2.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |