CVE-2026-14596 describes an improper authentication vulnerability (CWE-287) in the DynamicKit for Elementor WordPress plugin prior to version 1.0.3. The vulnerability arises because the plugin does not validate the host component of a user-supplied URL used to generate password-reset links emailed to users. An attacker can exploit this by sending a legitimate-looking password reset email with a link that directs the user to an attacker-controlled domain while still carrying a valid reset key. This can result in account takeover if the victim follows the link.

An attacker can send a victim a password reset email with a link that appears legitimate but directs to an attacker-controlled host. Because the reset key is valid, the attacker can hijack the victim's account if the victim clicks the link. This compromises user account security and can lead to unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 1.0.3, upgrading to version 1.0.3 or later (if available) is recommended once confirmed. Until a patch is available, avoid using the affected plugin or restrict password reset functionality. Monitor official vendor channels for updates.