Description
The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: (1) the masterstudy_ms_stm_set_discard_transient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient key without capability checks or nonce validation, and (2) the developer access login mechanism in admin/classes/stm-theme-support.php authenticates users based on a transient value without proper cryptographic validation when in legacy string mode. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the stm_developer_access_token transient to a known value (1), then authenticate as any existing user including administrators by visiting a specially crafted URL, thereby achieving full privilege escalation to administrator.
Published: 2026-09-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

The Consulting – Business, Finance theme for WordPress contains a failure in permission checks on an AJAX endpoint and a legacy login mechanism that trusts a transient key. An authenticated user with subscriber-level rights can assign a known value to the stm_developer_access_token transient and then visit a specially crafted URL that bypasses normal authentication. As a result the attacker can log in as any existing user, including site administrators, and gain full control of the site. This vulnerability is classified as a privilege escalation flaw, corresponding to CWE-269.

Affected Systems

The affected vendor is StylemixThemes and the product is the Consulting – Business, Finance WordPress Theme. All releases 6.7.16 and earlier are vulnerable. Hosts running any of these versions should upgrade to a newer release that removes the unprotected AJAX endpoint and corrects the legacy authentication logic.

Risk and Exploitability

The CVSS base score of 8.8 marks it as high severity. The EPSS score is less than 1%, indicating a low but nonzero probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely via HTTP requests to the vulnerable endpoint and clear the transient to elevate privileges. If a website runs a vulnerable version, the risk is significant due to the lack of mitigation and the ease of crafting the required request.

Generated by OpenCVE AI on September 17, 2026 at 15:45 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Consulting theme to version 6.7.17 or newer, which removes the unprotected AJAX endpoint and fixes the developer‑access token handling.
  • If an update cannot occur immediately, block the /wp-admin/admin‑notices and any custom AJAX URLs that contain "masterstudy_ms_stm_set_discard_transient" using a firewall or by requiring HTTP basic authentication for the admin area.
  • Disable legacy developer mode by clearing or disabling the "stm_legacy_string_mode" configuration, or removing the legacy code that trusts transient values for authentication.

Generated by OpenCVE AI on September 17, 2026 at 15:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Stylemixthemes
Stylemixthemes consulting - Business, Finance Wordpress Theme
Wordpress
Wordpress wordpress
Vendors & Products Stylemixthemes
Stylemixthemes consulting - Business, Finance Wordpress Theme
Wordpress
Wordpress wordpress

Thu, 17 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Description The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: (1) the masterstudy_ms_stm_set_discard_transient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient key without capability checks or nonce validation, and (2) the developer access login mechanism in admin/classes/stm-theme-support.php authenticates users based on a transient value without proper cryptographic validation when in legacy string mode. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the stm_developer_access_token transient to a known value (1), then authenticate as any existing user including administrators by visiting a specially crafted URL, thereby achieving full privilege escalation to administrator.
Title Consulting - Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX
Weaknesses CWE-269
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Stylemixthemes Consulting - Business, Finance Wordpress Theme
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-09-17T14:26:49.651Z

Reserved: 2026-07-06T00:48:07.641Z

Link: CVE-2026-14805

cve-icon Vulnrichment

Updated: 2026-09-17T14:26:44.055Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T13:16:40.507

Modified: 2026-09-17T15:16:41.150

Link: CVE-2026-14805

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T19:59:11Z

Weaknesses
  • CWE-269

    Improper Privilege Management