CVE-2026-14250 is a privilege escalation vulnerability in the Themehunk Login Registration plugin for WordPress. The vulnerability arises from the handle_frontend_register() function in the unauthenticated /thlogin/v1/register REST endpoint, which accepts a 'role' parameter from users. This parameter is validated only against get_editable_roles(), which includes all editable roles such as 'editor'. Consequently, attackers can register new accounts with elevated privileges without authentication, assuming public user registration is enabled. The vulnerability affects versions up to and including 1.0.2.

An unauthenticated attacker can exploit this vulnerability to create new user accounts with elevated privileges (e.g., editor role) on a WordPress site using the vulnerable plugin with public registration enabled. This could lead to unauthorized content modification and other actions permitted to users with the editor role. The CVSS 3.1 base score is 6.3 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low level.

No official patch or remediation is currently confirmed. Users should check the vendor advisory for updates. Until a fix is available, it is recommended to disable public user registration or restrict access to the /thlogin/v1/register endpoint to trusted users only to prevent exploitation.