CVE-2026-14805 describes a privilege escalation vulnerability in the Consulting - Business, Finance WordPress theme by StylemixThemes, affecting versions up to 6.7.16. The vulnerability results from two combined issues: (1) the masterstudy_ms_stm_set_discard_transient AJAX endpoint accepts arbitrary transient keys without verifying user capabilities or nonce tokens, and (2) the developer access login mechanism authenticates users based on a transient value without proper cryptographic validation in legacy string mode. This allows authenticated users with subscriber-level privileges or higher to set the stm_developer_access_token transient to a known value and then authenticate as any existing user, including administrators, by accessing a specially crafted URL, thereby achieving full privilege escalation.

Successful exploitation allows an authenticated user with subscriber-level access or above to escalate privileges to administrator. This results in full control over the WordPress site, including the ability to modify content, install plugins, change configurations, and potentially compromise the entire site and its data. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

A patch is available for this vulnerability. Users of the Consulting theme should update to a fixed version beyond 6.7.16 as soon as possible. Since this is a WordPress theme, applying the official update from StylemixThemes will remediate the issue. No additional mitigations are indicated by the vendor advisory. Patch status is confirmed by the presence of patchAvailable=true and affected versions up to 6.7.16.