IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
9.8Crítica

CVE-2026-115214Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers

Datawiza Proxy Auth Plugin Publicada: (hace 9 días)

Descripción

The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.

Debilidad (CWE): CWE-269

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
— Datawiza Proxy Auth Plugin 1.1.0 – < 1.1.1

Referencias y parches

CVE recientes del mismo producto — WordPress plugins & themes

Sin puntuación
CVE-2026-104648

weMail <= 2.1.6 - Editor+ API Key Disclosure

weMail

The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credentia…