CVE-2026-14805: Consulting - Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX
The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: (1) the masterstudymsstmsetdiscardtransient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient key without capability checks or nonce validation, and (2) the developer access login mechanism in admin/classes/stm-theme-support.php authenticates users based on a transient value without proper cryptographic validation when in legacy string mode. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the stmdeveloperaccesstoken transient to a known value (1), then authenticate as any existing user including administrators by visiting a specially crafted URL, thereby achieving full privilege escalation to administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Consulting themeto a version that resolves this vulnerability.Fixed in 6.7.16 - Compensating control
Restrict access to WordPress admin endpoints (especially admin/admin-notices/classes/STMHandler.php and admin/classes/stm-theme-support.php) to trusted users/IPs using a firewall/ACL or similar network-level restriction until the vulnerable theme version is updated.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already have an authenticated WordPress account with at least Subscriber-level access. They can then escalate to an administrator account, including any existing administrator user.
Does exploitation require user interaction or a difficult attack setup?
No user interaction is required, and the attack complexity is low. The attacker needs to issue an AJAX request to set the developer-access transient to a known value and then visit a specially crafted URL.
What versions are affected?
Consulting theme versions up to and including 6.7.16 are affected.
How can I determine whether exploitation may have occurred?
Review WordPress authentication and administrator-account activity for unexpected logins, particularly logins to existing administrator accounts from accounts that previously held only Subscriber-level access. Also investigate suspicious requests to the masterstudy_ms_stm_set_discard_transient AJAX endpoint and unexpected use of developer-access login URLs.