{"id":"CVE-2026-115214","published":"2026-10-25T06:16:32.263","lastModified":"2026-10-26T13:52:56.910","description":"The Datawiza Proxy Auth Plugin  WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/2c6c7d10-2281-4a98-a0d6-769da5cce416/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Datawiza Proxy Auth Plugin before 1.1.1 for WordPress trusts user-identity and role HTTP headers without verifying they come from a trusted reverse proxy, allowing unauthenticated attackers to forge these headers and gain administrative access.","exploitability":"Trivial to exploit over the network with no authentication or user interaction required; only requires sending crafted HTTP requests to the WordPress site.","blast_radius":"Successful exploitation grants full administrative control of the WordPress instance, enabling complete site takeover, data exfiltration, malware deployment, and lateral movement if the host is on a broader network.","remediation":"Upgrade to Datawiza Proxy Auth Plugin version 1.1.1 or later, which implements proper validation that the required HTTP headers originate from an authorized reverse proxy.","detection":"Look for HTTP requests containing X-Forwarded-User, X-Auth-User, or similar identity/role headers (e.g., X-Forwarded-Role: administrator) sent directly to WordPress endpoints without passing through a known reverse proxy; such headers arriving from non-proxy IPs or lacking expected proxy metadata (e.g., missing X-Forwarded-For from trusted ranges) are highly suspicious.","tags":["auth-bypass","wordpress","reverse-proxy","privilege-escalation","web"],"model":"garnet-coder","analyzedAt":"2026-10-27T08:47:28.182Z"}}