WordPress Plugin Vulnerabilities

Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers

Description

The plugin does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.

Proof of Concept

Affects Plugins

Plugin icon
reverse-proxy-auth-widget
Fixed in 1.1.1

References

CVE
CVE-2026-115214

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes
WPVDB ID
2c6c7d10-2281-4a98-a0d6-769da5cce416

Timeline

Publicly Published
2026-10-23 (about 2 days ago)
Added
2026-10-23 (about 1 day ago)
Last Updated
2026-10-24 (about 8 hours ago)

Other

Published
Title
Published
2026-05-16
Title
AI Engine 3.4.9 - Subscriber+ Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token
Published
2026-05-28
Title
Advanced Custom Fields: Extended < 0.9.2.6 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter
Published
2019-05-31
Title
WP Live Chat Support < 8.0.33 - Missing Permission Checks on some REST API Calls
Published
2026-04-10
Title
BuddyPress Groupblog < 1.9.4 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDOR
Published
2020-03-16
Title
LearnPress < 3.2.6.7 - Privilege Escalation