WordPress Plugin Privilege Escalation via Insufficient AJAX Authorization

The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the `wp_ajax_pos_get_option` AJAX handler, which verifies only a nonce that is localized to every logged-in admin-area user via `admin_enqueue_scripts` — without any capability check — before returning the value of any arbitrary WordPress option via `get_option()`, combined with the `admin_login_endpoint_handler` REST endpoint (`GET /wp-json/epm/v1/admin/login`) being registered as publicly accessible and authenticating callers solely by a whirlpool hash of values stored in those same options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the `site_url`, `connection_key`, and `remote_user_id` values stored in the `eazywp_connecting_info` and `eazywp_connection` options, compute the required `auth_key`, call the

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Eazy Plugin Manager vulnerability exploits a critical gap in WordPress AJAX handler security. The `wp_ajax_pos_get_option` function relies solely on nonce verification—a token distributed to all logged-in admin users—without checking user capabilities before exposing arbitrary WordPress options via `get_option()`. This means any authenticated user, regardless of their intended role, can retrieve sensitive configuration data they shouldn't access. With a CVSS score of 8.8, this affects all versions up to 4.4.1 of a widely-used plugin, creating a significant exposure window for WordPress administrators managing multi-user environments where role separation is critical.

Casky's 224 matched security skills detect this vulnerability pattern through MITRE ATT&CK technique TA0004 (Privilege Escalation) analysis. Practitioners using Claude AI with extended reasoning would identify multiple attack indicators: improper AJAX nonce validation without capability checks (CWE-269: Improper Access Control), suspicious `wp_ajax_*` handler calls from lower-privileged users, and unauthorized calls to `get_option()` retrieving restricted WordPress options like database credentials or API keys. Casky's findings would highlight the authentication bypass pathway—attackers crafting AJAX requests with valid nonces to exfiltrate sensitive data—and recommend immediate capability verification enforcement in AJAX handlers, role-based access controls validation, and option-level data protection strategies across WordPress deployments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-14328.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-14328

Casky has 224 skills that investigate the attack patterns behind CVE-2026-14328. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn