CVE-2026-14444

WP Fusion (Pro), the premium edition of a WordPress integration plugin, contains a privilege escalation flaw (CWE-269) in the thrivecart() function of its ThriveCart Auto Login handler, where the role parameter is not properly authorization-checked in all versions up to and including 3.47.13. To exploit it, an attacker needs an account on the target site at Subscriber level or above and knowledge of the site's ThriveCart access_key — a secret that the plugin's documented setup process intentionally shares with ThriveCart customers, meaning anyone who has completed a purchase through the site's ThriveCart checkout may already possess it — and can then send a crafted auto-login request that creates a new user with the administrator role. The attacker thereby gains full control of the WordPress site via that administrator account. Only sites running WP Fusion Pro with the ThriveCart Auto Login option enabled are affected, and the most realistic attackers are users who both hold an account on the site and have passed through its ThriveCart checkout. No public proof-of-concept or confirmed in-the-wild exploitation is known; the issue is not in CISA's KEV catalog, and EPSS currently estimates a 0.2% probability of exploitation within 30 days.

What to do: Update WP Fusion Pro to the latest release (anything newer than 3.47.13); as an interim mitigation, disable the ThriveCart Auto Login option in the plugin settings. Administrators should also review the users list for unexpected or recently created administrator accounts, since past customers who received ThriveCart auto-login links may already know the shared access_key.