High CVSS 8.8
CVE-2026-14596
NVD analysis in progress
The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an attacker-controlled host and carries a valid reset key, leading to account takeover when the victim clicks it.
What this means
- Exposure
- Exploitable remotely over the network and without authentication — but only if a user opens booby-trapped content.
- Impact
- An attacker can read sensitive data, modify or destroy data and take the service offline.
- Weakness
- The authentication mechanism can be bypassed, letting an attacker pose as a legitimate user.
- Likelihood
- Its EPSS score stays low: nothing points to imminent exploitation, which is no reason to leave it unpatched.
What to doFold into the next patch cycle.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.