CVE-2026-115214: CWE-269 Improper Privilege Management in Datawiza Proxy Auth Plugin
Affects Datawiza Proxy Auth PluginSource CVE Database V5
Not known to be exploited.
Data as of 10/25/2026, 06:20:55 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Datawiza Proxy Auth Plugin | Affected
| Fixed in
|
AI-suggested
Upgrade the Datawiza Proxy Auth Plugin to version 1.1.1 or later, where this vulnerability is fixed.
Description
The Datawiza Proxy Auth Plugin for WordPress before version 1.1.1 has an improper privilege management vulnerability. It fails to verify that user-identity and role HTTP headers originate from a trusted reverse proxy. This flaw allows unauthenticated attackers to create and authenticate as WordPress administrators.
Impact
An unauthenticated attacker can exploit this vulnerability to gain administrative access to a WordPress site using the affected plugin versions. This could lead to full site compromise, including content modification, user management, and potential further exploitation of the underlying WordPress installation.
Weaknesses
- CWE-269Improper Privilege Management (opens in a new tab)
Class weaknessLikelihood of exploit: MediumOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.