CVE-2026-14444 is a privilege escalation vulnerability in the WP Fusion (Pro) WordPress plugin affecting all versions up to and including 3.47.13. The vulnerability is due to improper privilege management (CWE-269) caused by insufficient authorization checks on the role parameter within the thrivecart() function of the ThriveCart Auto Login handler. Authenticated attackers with Subscriber-level privileges or higher who have the access_key—shared with legitimate ThriveCart customers—can exploit this flaw to create new user accounts with administrator privileges, thereby gaining full control over the WordPress site. Exploitation requires the ThriveCart Auto Login feature to be enabled.

Successful exploitation allows an attacker with low-level authenticated access and the access_key to escalate privileges to administrator, resulting in complete control over the affected WordPress site. This includes the ability to modify site content, install malicious plugins, and compromise site integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable the ThriveCart Auto Login option to prevent exploitation. Additionally, restrict access to the access_key to trusted parties only and monitor for unauthorized account creation.