CVE-2026-115214 PUBLISHED

Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers

Assigner: WPScan
Reserved: 22.10.2026 Published: 25.10.2026 Updated: 25.10.2026

The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.

Product Status

Vendor Unknown
Product Datawiza Proxy Auth Plugin
Versions Default: unaffected
  • affected from 1.1.0 to 1.1.1 (excl.)

Credits

  • Naoki Kawahigashi finder
  • WPScan coordinator

References

Problem Types

  • CWE-269 Improper Privilege Management CWE