CVE-2026-14356

Name of the Vulnerable Software and Affected Versions FleekDash V2 versions prior to 2.6.2.3

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can overwrite the email address and password of any WordPress user, including administrators, leading to full account takeover and site compromise. Additionally, the /wp-json/fleekdash/v1/register endpoint auto-provisions a Subscriber-role account and returns a valid REST nonce regardless of the users can register setting, allowing unauthenticated attackers to obtain the necessary credentials and nonce.

Recommendations Update FleekDash V2 to version 2.6.2.3 or later.