CVE-2026-14482 is a privilege escalation vulnerability in the 多说社会化评论框 WordPress plugin (all versions up to 1.2). The issue arises from a missing capability and nonce verification on an API endpoint combined with a trivially forgeable HMAC-SHA1 signature keyed on an always-empty WordPress option. This flaw allows unauthenticated attackers to invoke the endpoint's update_option handler with attacker-controlled parameters that are passed directly to WordPress's update_option function without any allowlist or sanitization. Consequently, attackers can modify critical WordPress options such as 'default_role' and enable open registration, leading to the creation of accounts with full administrator privileges.

An unauthenticated attacker can escalate privileges by modifying WordPress configuration options arbitrarily. This includes setting the default user role to administrator and enabling open registration, which allows the attacker to register an administrator account. The vulnerability impacts confidentiality, integrity, and availability of the affected WordPress site, as attackers gain full administrative control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable plugin or disable it to prevent exploitation. Monitor for updates from the plugin vendor or WordPress security advisories for a patch or official mitigation.