Authorizer WordPress plugin: Unauthenticated privilege escalation

Summary

The Authorizer WordPress plugin up to and including version 3.15.3 contains a privilege escalation flaw that can be exploited without authentication. According to Patchstack, a low-privilege user can become an administrator and gain full control of the WordPress site. The CVSS score is 9.8 (critical), and the attack requires no user interaction over the network. The root cause is not confirmed by the vendor; a related record (CVE-2026-81294) suggests an OAuth2 email verification issue, which is still being verified.

Affected

• Authorizer WordPress plugin, versions 3.15.3 and earlier (per CVE record and Patchstack)
• Related record CVE-2026-81294 reportedly affects 3.15.1 and earlier; overlap not confirmed

Fixed in

• Version 3.16.0 (Patchstack and vendor release channel)
• Conflict: CVE-2026-81294 names 3.15.2 as fix; confirm with Patchstack. Until then, 3.16.0 is the safe target.

Workaround

• No vendor workaround confirmed; update is the primary action.
• Patchstack blocks requests to this flaw as a virtual patch (Patchstack product feature, not a vendor mitigation).
• Before upgrading, confirm the server can send email, or set an explicit Tenant ID in the Azure OAuth2 configuration (per 3.16.0 changelog).
• If patching is not possible at once, disable the plugin or the external-login feature (own recommendation).

Exploitation

• No confirmed in-the-wild exploitation; not listed in KEV (per Strix).
• Patchstack expects exploitation and mass-exploit use for this class of flaw, as a general statement.
• No public proof of concept found for this CVE; a reproduction lab exists for the related CVE-2026-81294.
• CISA SSVC: exploitation none, automatable yes, technical impact total.

Our recommendation

• Inventory all WordPress sites for the Authorizer plugin.
• Update to version 3.16.0 or later immediately on affected sites.
• Review administrator accounts and recently created users for signs of abuse.
• Check whether Azure or other OAuth2 login is used.
• Confirm the fixed version with the vendor or Patchstack.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  anoxhunterdump-ctrl/CVE-2026-103752-Authorizer-Privilege-Escalation

Research sources

• Patchstack advisory for Authorizer plugin patchstack.com
• Authorizer plugin on WordPress.org wordpress.org
• Strix CVE-2026-103752 www.strix.ai
• CVE-2026-81294 (cve.report) cve.report
• CVE-2026-81294 (exploit-intel) exploit-intel.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:37.