CVE-2026-14805

The Consulting theme for WordPress, in versions up to and including 6.7.16, chains two flaws that let any authenticated user with subscriber-level access or above escalate to full administrator privileges. The unprotected masterstudy_ms_stm_set_discard_transient AJAX endpoint in admin/admin-notices/classes/STMHandler.php allows an attacker to set arbitrary transients without capability checks or nonce validation, so they can set stm_developer_access_token to a known value (1). Because the developer-access login mechanism in admin/classes/stm-theme-support.php trusts that transient for authentication when running in legacy string mode, visiting a specially crafted URL then logs the attacker in as any existing user, including administrators. Any site running the theme at or below 6.7.16 where an attacker can obtain even a low-privileged account (e.g., via open registration) is affected. No public PoC exists and no exploitation in the wild has been reported, though the attack is straightforward to reproduce for anyone with the technical details.

What to do: Update to the latest Consulting theme release (any version newer than 6.7.16) as soon as the vendor ships a fix; until then, disable open user registration and audit existing low-privileged accounts. Check for unexpected stm_developer_access_token transient values and any newly created or modified administrator accounts, and consider a WAF rule blocking the masterstudy_ms_stm_set_discard_transient AJAX action and the developer-access login URL.