External risk intelligence

Authorizer Plugin Unauthenticated Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-103752

The vulnerability affects a WordPress plugin named Authorizer, which is designed to manage user access and authentication. Such plugins are typically installed on web servers to control public-facing website access, making the vulnerable code path frequently exposed to the internet.

Privilege Escalation

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Authorizer technology, which is used for managing user access and authentication. This issue could potentially allow unauthorized users to gain elevated privileges, impacting system integrity and data confidentiality. The main concern at this time is to confirm if this technology is in use and assess any potential exposure.

Unauthenticated users can gain elevated privileges.
This affects user access control systems.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to the Authorizer component. This could allow an unauthenticated user to gain elevated privileges within the system, potentially leading to complete compromise.

No authentication required.
Triggered via network request.
Leads to privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated privilege escalation vulnerability in the Authorizer plugin could allow an attacker to gain elevated administrative privileges on a WordPress site when the plugin is installed and active. This could potentially lead to unauthorized modifications of site content, user management, or configuration settings.

Administrative access and site control.
Network-accessible vulnerable code path.
Unauthorized site modification or data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Authorizer, affecting unauthenticated privilege escalation, likely impacts web application owners and infrastructure teams managing WordPress sites. The immediate practical step is to identify all instances of the affected plugin, confirm their exposure and business criticality, and then assign ownership for remediation planning.

Application owners should own this issue.
Verify all Authorizer plugin deployments.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Authorizer plugin for WordPress?

Authorizer is a WordPress plugin designed to handle user authentication and access control. Administrators use it to gate access to their websites, ensuring that only authorized users can view content or interact with the site. It acts as a security layer for managing who can log in and what level of access they have.

What does CWE-266 mean for CVE-2026-103752?

CWE-266 refers to Incorrect Privilege Assignment. In the context of this CVE, it means the plugin fails to properly check a user's permissions or identity. Because of this weakness, an unauthorized user can interact with the system in a way that falsely grants them elevated rights, such as administrative access, without ever providing valid credentials.

How is this privilege escalation triggered?

An attacker triggers this vulnerability by sending a specifically crafted network request to the plugin. Because the vulnerability exists in the plugin's code, it does not require the attacker to be logged in or have a valid user account. Simply interacting with the plugin's accessible functions over the network is sufficient to initiate the attack; legitimate user actions do not trigger this.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal flags this as a high-priority concern because Authorizer is typically deployed on public-facing web servers. Since the plugin's purpose is to manage site access, its code is inherently exposed to the internet. If your WordPress instance is reachable from the web, the vulnerable path is likely accessible to any external attacker.

What should I do if I use the Authorizer plugin?

The immediate priority is to locate all instances of the Authorizer plugin running within your environment to determine where it is active. Once identified, evaluate the criticality of the websites using it and begin planning for remediation. This ensures you have a clear inventory of impacted systems before taking steps to mitigate or remove the vulnerable software.

References

patchstack.com/database/wordpress/plugin/authorizer/vulnerability/wo…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.