CVE-2026-14378 describes an authentication bypass vulnerability in the DevKit Pro WordPress plugin (<=2.3.0). The `revert_switch` handler trusts an attacker-controlled `original_user_id` cookie to identify privileged users. The function `verify_nonce_and_capability()` incorrectly checks the `manage_options` capability on the user ID from this cookie rather than the actual requester, while a valid session-bound nonce and switch-back form are publicly exposed in the page footer to any visitor when the cookie is present. This allows unauthenticated attackers to set the cookie to an administrator's ID, retrieve the nonce, and submit a request that triggers `wp_set_auth_cookie()` with the administrator's ID, granting full administrator session and site control.

Successful exploitation results in complete site takeover with administrator privileges, including full confidentiality, integrity, and availability compromise of the affected WordPress site. The vulnerability has a CVSS 3.1 score of 9.8 (critical), reflecting its high impact and ease of exploitation without authentication.

No patch or official fix is currently documented in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin or disable it to prevent exploitation.