CVE-2026-14250

Name of the Vulnerable Software and Affected Versions Themehunk Login Registration versions prior to 1.0.3

Description An issue exists where unauthenticated attackers can achieve privilege escalation when public user registration is enabled. The handle frontend register() function in the '/thlogin/v1/register' REST endpoint accepts a user-controlled role parameter. This parameter is validated using get editable roles(), which includes all editable site roles such as 'editor', before being passed to wp insert user(). This allows an attacker to create new accounts with elevated privileges, specifically the editor role.

Recommendations Update Themehunk Login Registration to a version newer than 1.0.2. As a temporary mitigation, disable public user registration or restrict access to the '/thlogin/v1/register' endpoint.