Datawiza Proxy Auth Plugin: Authentication bypass via trusted headers allows admin takeover
Summary
The Datawiza Proxy Auth Plugin for WordPress before 1.1.1 trusts the user-identity and role HTTP request headers without verifying that they come from a trusted reverse proxy. An unauthenticated remote attacker can send these headers directly to the website, create an account and log in as a WordPress administrator. Successful exploitation gives full control over the website; the CVSS base score is 9.8 (critical).
Affected
- Datawiza Proxy Auth Plugin for WordPress 1.1.0 up to, but not including, 1.1.1
- Earlier versions: Unknown. Treat all versions below 1.1.1 as affected until the vendor confirms otherwise.
- Slug naming: WPScan lists the plugin as "reverse-proxy-auth-widget"; check the installed slug against your inventory.
Fixed in
- Version 1.1.1 (according to WPScan). The vendor changelog could not be verified.
Workaround
- No vendor workaround known.
- If the plugin is not needed, deactivate and remove it.
- If it is needed, allow connections to the WordPress origin only from the reverse proxy (firewall or allowlist).
- Make sure the proxy strips or overwrites identity and role headers from client requests.
Exploitation
- Not listed in CISA KEV; no source reports exploitation in the wild.
- CISA SSVC: automatable yes, technical impact total.
- Public exploit code: sources conflict; not confirmed.
- A Nuclei community template (pull request #17548) for version-based detection is proposed; merge status unknown.
- EPSS: sources disagree (0.14% to 0.2%).
Our recommendation
- Check whether the plugin is installed and which version is active; update to 1.1.1 or later.
- If not needed, deactivate and remove the plugin.
- Verify that the website only accepts traffic from the reverse proxy.
- Review the list of administrator accounts for unknown users and check logs for unexpected admin logins.
- Monitor for suspicious account creation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability record wpscan.com
- OpenCVE CVE-2026-115214 app.opencve.io
- VulDB 426157 vuldb.com
- Nuclei template pull request #17548 github.com
- WordPress.org plugin page wordpress.org
- OffSeq Radar threat entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:36.
Original description (NVD)
The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.