CVE-2026-115214
Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers
Fetching some sources has been requested. Reload in about a minute to see them.
CVSS v3.1 (listed by NVD)
—
Not scored
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
—
Not scored
EPSS exploit probability
—
Not computed
CISA KEV
—
Not listed
Description
CNA (WPScan)
The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Datawiza Proxy Auth Plugin | affected: 1.1.0 … < 1.1.1 default: unaffected |
Linux distribution status
References (1)
- https://wpscan.com/vulnerability/2c6c7d10-2281-4a98-a0d6-769da5cce416/ CNA exploitvdb-entrytechnical-description