CVE-2026-115214

Description

The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.

References

https://wpscan.com/vulnerability/2c6c7d10-2281-4a98-a0d6-769da5cce416/

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109352

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3