CVE-2026-115214 Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers
CriticalCVSS 9.8
EPSS 0.28%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress reverse-proxy-auth-widget(WordPress) | < 1.1.1 | 1.1.1 |
References
- wpscan.com exploit technical-description vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org