CVE-2026-14356 is an authorization bypass vulnerability in the FleekDash V2 WordPress plugin affecting all versions up to and including 2.6.2.2. The vulnerability arises because the plugin does not properly verify user authorization before allowing sensitive actions. Authenticated users with subscriber-level privileges or above can overwrite credentials of any WordPress user, including administrators. The vulnerability is exacerbated by a public REST API endpoint (/wp-json/fleekdash/v1/register) that allows unauthenticated attackers to create subscriber accounts and obtain valid REST nonces regardless of the site's registration settings, enabling them to escalate privileges and take over accounts.

Successful exploitation enables attackers to fully compromise WordPress sites by taking over any user account, including administrators. This leads to complete site control, data compromise, and potential further malicious activity. The vulnerability requires only subscriber-level access or can be exploited by unauthenticated attackers through the registration endpoint to gain such access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /wp-json/fleekdash/v1/register endpoint if possible, and monitor for suspicious account creation activity. Avoid granting subscriber-level access to untrusted users. Follow updates from the FleekDash vendor for an official patch or temporary mitigation.