CVE-2026-14482
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The 多说社会化评论框 plugin for WordPress up to version 1.2 contains a privilege escalation vulnerability. Missing capability and nonce checks on a web-accessible API endpoint, combined with a trivially forgeable HMAC-SHA1 signature, allow unauthenticated attackers to update arbitrary WordPress options. Attackers can set the default role to administrator, enable registration, and then register an account with full admin privileges.
Risk Assessment
The risk to the organization is critical as an unauthenticated attacker can gain full control over the WordPress installation, leading to site takeover, data theft, or further attacks on users.
Recommendation
Immediately remove or update the 多说社会化评论框 plugin to the latest available version if a patch has been released. Otherwise, completely disable and uninstall the plugin to eliminate the vulnerability.
Original NVD description (English source)
The 多说社会化评论框 plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. The vulnerability exists due to a missing capability and nonce check on a directly web-accessible API endpoint, combined with a trivially forgeable HMAC-SHA1 signature keyed on an always-empty WordPress option, which allows the endpoint's `update_option` handler to pass attacker-controlled `option` and `value` parameters directly to WordPress's `update_option` function without any allowlist or sanitization. This makes it possible for unauthenticated attackers to update arbitrary WordPress options — such as setting `default_role` to `administrator` and enabling open registration — and subsequently register an account with full administrator privileges.