DevKit Pro WordPress plugin: Authentication bypass to administrator takeover
Summary
DevKit Pro for WordPress up to and including 2.3.0 contains an authentication bypass. An unauthenticated attacker can set a manipulated original_user_id cookie, collect a nonce that the plugin publishes in the public page footer, and submit it to the revert_switch handler. This creates an administrator session and gives the attacker full control of the site (CVSS 9.8). A public proof-of-concept exists, and no workaround has been published by the vendor.
Affected
- dplugins DevKit Pro, all versions up to and including 2.3.0
Fixed in
Unknown.
- Sources disagree on the first fixed version (2.3.1 or 3.0.0 are claimed by third parties).
- The vendor changelog does not clearly list a fix for this issue.
- Install the newest DevKit Pro release and verify the installed version after the update.
Workaround
Unknown. No vendor workaround published.
- Deactivate or remove DevKit Pro until a fixed version is installed.
- If removal is not possible, disable the Users Manager switch feature.
Exploitation
- Public proof-of-concept: yes.
- Exploited in the wild: no confirmed reports at the time of research.
- Not listed in the CISA KEV catalog at the time of research. Mass exploitation is considered plausible.
Our recommendation
- Check every WordPress site for DevKit Pro and its version.
- Update DevKit Pro to the newest release immediately on sites at 2.3.0 or older, or remove the plugin.
- Check for unknown administrator accounts, recently changed admin passwords and unknown sessions.
- Review web server logs for requests with an original_user_id cookie.
- If compromise is suspected, reset administrator credentials and invalidate all sessions.
- Monitor the CISA KEV catalog for this CVE.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (2 repositories)
anoxhunterdump-ctrl/CVE-2026-14378-DevKit-Pro-Auth-Bypass · murrez/CVE-2026-14378
Research sources
- NVD/Wordfence CVE record reference (Wordfence threat intel) www.wordfence.com
- DevKit changelog (vendor, NVD reference) docs.dplugins.com
- Auth bypass cluster write-up (dev.to) dev.to
- Proof-of-concept repository (GitHub) github.com
- CVE summary (cvefeed.io) cvefeed.io
- CVE summary (OpenCVE) app.opencve.io
- The Hacker Wire entry www.thehackerwire.com
- Exploit listing (vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:30.
Original description (NVD)
The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the `revert_switch` handler trusting the attacker-controlled `original_user_id` cookie as the privileged identity: `verify_nonce_and_capability()` incorrectly checks the `manage_options` capability on the user identified by the cookie rather than on the actual requester via `current_user_can()`, while the switch-back form and a valid session-bound nonce are emitted publicly via `wp_footer` to any visitor — including unauthenticated users — whenever that cookie is present. This makes it possible for unauthenticated attackers to set the `original_user_id` cookie to any administrator's user ID, collect the rendered nonce, and POST it back to the `revert_switch` handler, causing `wp_set_auth_cookie()` to be called with the administrator's ID and granting the attacker a full administrator-level authenticated session and complete site takeover.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.