CVE-2026-14596 describes an improper authentication vulnerability (CWE-287) in the DynamicKit for Elementor WordPress plugin prior to version 1.0.3. The flaw arises because the plugin does not validate the host component of a user-supplied URL used as the base for password-reset links emailed to users. An unauthenticated attacker can exploit this by crafting a reset email with a legitimate reset key but a link pointing to an attacker-controlled domain. When the victim clicks the link, the attacker can gain control of the victim's account.

Successful exploitation allows unauthenticated attackers to perform account takeover by sending victims password reset emails with links that appear legitimate but redirect to attacker-controlled hosts. This compromises confidentiality, integrity, and availability of user accounts in affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with password reset emails and verify URLs before clicking. Monitoring for updates from the plugin vendor is recommended.