External risk intelligence

Datawiza Proxy Auth Plugin Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-115214

This is a WordPress plugin vulnerability. WordPress sites are typically deployed as public-facing web applications. Because this plugin affects authentication and authorization mechanisms for the site, it is inherently positioned to handle web traffic, making it commonly reachable from the public internet in standard WordPress deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in the Datawiza Proxy Auth Plugin for WordPress that could allow unauthenticated attackers to gain administrator access. The plugin incorrectly trusts HTTP headers for user identity, potentially enabling unauthorized elevation of privileges on affected WordPress sites. The main concern is confirming relevance and exposure.

Unauthenticated admins can be created.
Compromises website administrator access.
Confirm if your WordPress sites are impacted.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by sending specially crafted HTTP requests to a WordPress site that has the vulnerable plugin installed. The plugin incorrectly trusts user-identity and role information sent in request headers, even if these headers did not originate from a trusted source like a reverse proxy. This allows an unauthenticated attacker to impersonate an administrator and gain full control of the WordPress site.

Unauthenticated access to the website.
Tricking the plugin with forged headers.
Full administrative control of the site.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to bypass authentication and gain administrative access to a WordPress site. This may occur when the affected plugin is used behind a reverse proxy that is not properly configured to validate trusted headers.

Administrative access to WordPress sites.
HTTP request headers are not verified.
Unauthorized administrator control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Datawiza Proxy Auth Plugin is used in WordPress environments, suggesting that application owners and platform teams responsible for managing WordPress instances should take the lead. The initial step involves identifying all WordPress sites utilizing this plugin, confirming their exposure and criticality, and then associating the affected systems with their respective owners to plan remediation.

Application owners should investigate.
Verify plugin reachability and criticality.
Plan targeted remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Datawiza Proxy Auth Plugin for WordPress?

This software is an authentication plugin designed to integrate WordPress sites with external identity providers. It acts as a bridge, allowing WordPress to delegate login processes to a reverse proxy that manages user sessions and identities, ensuring that only authenticated traffic reaches the application.

What does CVE-2026-115214 mean for security?

This vulnerability is classified as Improper Privilege Management (CWE-269). It occurs because the plugin fails to verify the origin of specific HTTP headers. Instead of confirming that these headers came from a trusted reverse proxy, the software blindly trusts them, allowing an attacker to inject fake identity data and gain administrative privileges.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending crafted HTTP requests to the target site. The bug is not caused by the presence of a reverse proxy itself; rather, it is triggered when the plugin accepts user-identity and role headers without validating their source. Requests that do not include these specific, forged headers do not trigger the authentication bypass.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal labels this as likely to be relevant because WordPress installations are typically public-facing. Since this plugin handles authentication logic directly, it is inherently exposed to incoming web traffic. If your WordPress site is reachable from the internet, it is within the primary scope for this type of attack.

How should I respond if I use this plugin?

Begin by auditing your WordPress environment to identify every instance where this plugin is installed. Prioritize these sites based on their data sensitivity and public reach. Once identified, ensure you are prepared to update to version 1.1.1 or later, which addresses the improper trust of HTTP request headers.

References

wpscan.com/vulnerability/2c6c7d10-2281-4a98-a0d6-769da5cce416/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.