CVE-2026-14482 is a privilege escalation vulnerability in the 多说社会化评论框 WordPress plugin affecting all versions up to and including 1.2. The vulnerability arises from a lack of proper capability and nonce verification on a directly accessible API endpoint. The endpoint uses an HMAC-SHA1 signature keyed on an always-empty WordPress option, which is trivially forgeable. This allows attackers to invoke the endpoint's update_option handler with attacker-controlled parameters that are passed directly to WordPress's update_option function without any allowlist or sanitization. Consequently, attackers can modify critical WordPress options such as default_role and user registration settings to gain administrator privileges.

An unauthenticated attacker can exploit this vulnerability to escalate privileges by modifying arbitrary WordPress options. This includes setting the default user role to administrator and enabling open registration, which allows the attacker to create accounts with full administrative rights. The impact includes full compromise of the affected WordPress site, with confidentiality, integrity, and availability all at high risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable plugin's API endpoints and consider disabling or removing the 多说社会化评论框 plugin if it is not essential. Monitor for updates from the vendor or plugin author for an official patch or mitigation.