Live › vulnerability › CVE-2026-115214
Go to dashboardThe Datawiza Proxy Auth Plugin for WordPress trusts user-identity and role HTTP headers without checking that they came from a trusted reverse proxy. An unauthenticated attacker can send forged headers to create and log in as a WordPress administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 06:36 UTC. All times on this page are UTC.
Sites running the Datawiza Proxy Auth Plugin before version 1.1.1 are exposed, because the plugin accepts identity and role headers from any client rather than only from the trusted proxy. Sites that do not use this plugin are not affected. The sources do not say whether the flaw depends on a particular proxy setup beyond the plugin being active.
No product ranges from the sources yet.
wp plugin list1.1.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.
This page as .md · .json · in your agent: get_signal("CVE-2026-115214")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.