Description

The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: (1) the masterstudy_ms_stm_set_discard_transient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient key without capability checks or nonce validation, and (2) the developer access login mechanism in admin/classes/stm-theme-support.php authenticates users based on a transient value without proper cryptographic validation when in legacy string mode. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the stm_developer_access_token transient to a known value (1), then authenticate as any existing user including administrators by visiting a specially crafted URL, thereby achieving full privilege escalation to administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-15T13:16:40.507Z",
  "pubdate": "2026-09-15T13:16:40.507Z",
  "executiveSummary": "The Consulting theme for WordPress, up to and including version 6.7.16, contains a critical privilege escalation vulnerability that poses a severe security risk to affected websites. This security flaw allows authenticated attackers, possessing only low-level subscriber permissions, to elevate their privileges to the administrator level. The vulnerability is highly exploitable because it does not require complex user interaction or sophisticated environment conditions, needing only standard subscriber-level access to initiate the exploit chain. By exploiting this vulnerability, an unauthorized user can gain total administrative control over the target WordPress installation.\nOnce administrative access is achieved, the attacker can perform arbitrary actions on the site, including installing malicious plugins, modifying sensitive database configurations, extracting user personal identifiable information (PII), or altering site content. This can lead to complete site takeover, defacement, and potential downstream compromise of the web server hosting the WordPress application. Organizations utilizing the Consulting theme are strongly advised to analyze their current installations and apply the necessary updates immediately to mitigate this critical risk to their digital assets.",
  "technicalDetails": "The technical root cause of this privilege escalation vulnerability lies in a critical combination of two distinct implementation flaws within the Consulting theme's administrative architecture. The first vulnerability is located in the masterstudy_ms_stm_set_discard_transient AJAX endpoint within admin/admin-notices/classes/STMHandler.php. This endpoint is designed to manage administrative notifications by updating transients but completely lacks capability checks or anti-CSRF nonce validation. Consequently, any authenticated user, regardless of their assigned role or permission level, can make requests to this endpoint and write arbitrary transient keys and values directly to the database.\nThe second flaw is situated within the developer access login mechanism defined in admin/classes/stm-theme-support.php. This component handles support authentication and is designed to allow developers access based on a transient token. When operating in legacy string mode, the mechanism authenticates incoming requests by verifying the presence of a specific transient value. However, the system fails to implement cryptographically secure verification, relying instead on a weak, predictable comparison check. It simply checks if the transient value is set and matches the expected state, without employing digital signatures or secure random token verification.\nThe attack flow proceeds in a sequential manner. First, the attacker registers or authenticates as a low-privileged user (such as a subscriber). Next, the attacker issues a specifically crafted AJAX request to the vulnerable masterstudy_ms_stm_set_discard_transient endpoint to set the stm_developer_access_token transient to a known, predictable value (specifically, 1). Because the endpoint lacks access control, this transient is successfully registered in the WordPress database. Finally, the attacker navigates to the administrative login endpoint using a specially structured URL. The login handler in admin/classes/stm-theme-support.php detects the stm_developer_access_token transient set to 1, bypasses standard password authentication, and immediately logs the attacker in as an administrator. This provides the attacker with full administrative privileges and total control over the WordPress application environment."
}