{"id":"CVE-2026-115214","kind":"vulnerability","aliases":["CVE-2026-115214"],"related":[],"title":"Datawiza Proxy Auth WordPress plugin: forged headers grant administrator login","description":"The Datawiza Proxy Auth Plugin  WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.","summary":"The Datawiza Proxy Auth Plugin for WordPress trusts user-identity and role HTTP headers without checking that they came from a trusted reverse proxy. An unauthenticated attacker can send forged headers to create and log in as a WordPress administrator.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["plugin-not-installed","plugin-version-1.1.1-or-later"],"how_to_check":"- Check whether the Datawiza Proxy Auth Plugin is installed and its version in the WordPress admin under Plugins, or with `wp plugin list`\n- Review whether the site sits behind the Datawiza proxy and whether the plugin is active\n- unknown for any other check, the sources do not say","fix":"- Update the Datawiza Proxy Auth Plugin to `1.1.1` or later\n- If no fixed version is installed, deactivate and remove the plugin until it is updated\n- Rotate WordPress administrator passwords and review administrator accounts created recently, since the sources say attackers can create them","status":"open","published_at":"2026-10-25T06:16:32+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","triaged_at":"2026-10-25T06:37:32+00:00","updated_at":"2026-10-25T06:37:32+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T06:37:32Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Datawiza Proxy Auth Plugin to `1.1.1` or later\n- If no fixed version is installed, deactivate and remove the plugin until it is updated\n- Rotate WordPress administrator passwords and review administrator accounts created recently, since the sources say attackers can create them","reach":"internet","title":"Datawiza Proxy Auth WordPress plugin: forged headers grant administrator login","impact":"high","summary":"The Datawiza Proxy Auth Plugin for WordPress trusts user-identity and role HTTP headers without checking that they came from a trusted reverse proxy. An unauthenticated attacker can send forged headers to create and log in as a WordPress administrator.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker becomes WordPress administrator and controls the site","analyst_note":"Confirm the exact affected version range and whether a default configuration is vulnerable; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115214 for CVSS and vendor advisory.","how_to_check":"- Check whether the Datawiza Proxy Auth Plugin is installed and its version in the WordPress admin under Plugins, or with `wp plugin list`\n- Review whether the site sits behind the Datawiza proxy and whether the plugin is active\n- unknown for any other check, the sources do not say","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-1.1.1-or-later"],"who_is_affected":"Sites running the Datawiza Proxy Auth Plugin before version 1.1.1 are exposed, because the plugin accepts identity and role headers from any client rather than only from the trusted proxy. Sites that do not use this plugin are not affected. The sources do not say whether the flaw depends on a particular proxy setup beyond the plugin being active.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000698,"input_tokens":3320,"output_tokens":732,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115214':13A,16A '-2026':12A,15A '1.1.1':74C 'administr':9A,65B,106C 'allow':96C 'attack':52B,98C 'auth':3A,28B,69C 'authent':102C 'came':44B 'check':41B 'creat':58B,100C 'cve':11A,14A 'datawiza':1A,26B,67C 'forg':6A,55B 'grant':8A 'header':7A,39B,56B,87C 'host':20B 'http':38B,85C 'ident':35B,82C 'log':60B 'login':10A 'origin':90C 'packag':17B 'plugin':5A,24B,29B,70C,72C 'proxi':2A,27B,49B,68C,95C 'request':86C 'revers':48B,94C 'role':37B,84C 'self':19B 'self-host':18B 'send':54B 'trust':32B,47B,89C,93C 'unauthent':51B,97C 'user':34B,81C 'user-ident':33B,80C 'verifi':77C 'without':40B 'wordpress':4A,21B,23B,31B,64B,71C,105C 'wordpress-plugin':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Datawiza Proxy Auth Plugin before version 1.1.1 are exposed, because the plugin accepts identity and role headers from any client rather than only from the trusted proxy. Sites that do not use this plugin are not affected. The sources do not say whether the flaw depends on a particular proxy setup beyond the plugin being active.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T06:16:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115214","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115214","severity":null,"published_at":"2026-10-25T06:16:32+00:00","modified_at":"2026-10-25T06:16:32+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","fetched_at":"2026-10-25T06:36:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}