WordPress security changelog
HIGH CVE-2026-14328 Deferred

Eazy Plugin Manager subscribers can escalate to Administrator

Eazy Plugin Manager through 4.4.1 allows any authenticated Subscriber to call wp_ajax_pos_get_option because the handler checks only a nonce localized to every logged-in admin-area user and performs no capability check. When the remote connection feature is configured, the attacker can read site_url, connection_key and remote_user_id from the eazywp_connecting_info and eazywp_connection options, derive the required whirlpool auth_key, and submit it to the public GET /wp-json/epm/v1/admin/login endpoint. admin_login_endpoint_handler then returns Administrator authentication cookies, enabling full site takeover. The CNA record does not disclose the request parameter used to select the option. No fixed public release is identified, and the WordPress.org plugin entry is closed.

CVE / CNA score 8.8 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress
Plugin slug
plugins-on-steroids
Affected
<= 4.4.1
Safe version
See mitigation notes
Published
Jul 28, 2026
Weakness
CWE-269 — Improper Privilege Management

This CVE was published Jul 28, 2026 and is one of 3 known issues for this plugin.

What to do

Update, patch or deactivate.

No fixed public release is currently available. Deactivate and remove Eazy Plugin Manager, particularly on sites where its remote connection feature has been configured. Rotate associated remote-connection credentials, invalidate WordPress sessions, and investigate Administrator and plugin activity for unauthorized access.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the `wp_ajax_pos_get_option` AJAX handler, which verifies only a nonce that is localized to every logged-in admin-area user via `admin_enqueue_scripts` — without any capability check — before returning the value of any arbitrary WordPress option via `get_option()`, combined with the `admin_login_endpoint_handler` REST endpoint (`GET /wp-json/epm/v1/admin/login`) being registered as publicly accessible and authenticating callers solely by a whirlpool hash of values stored in those same options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the `site_url`, `connection_key`, and `remote_user_id` values stored in the `eazywp_connecting_info` and `eazywp_connection` options, compute the required `auth_key`, call the `admin/login` REST endpoint to obtain Administrator authentication cookies, and fully take over the site. Exploitation requires the plugin's remote connection feature to have been configured, as the `eazywp_connecting_info` and `eazywp_connection` options must be populated with valid credentials.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources