CVE-2026-115214

None

CVSS

—

EPSS

0.3%

Published

Oct 25, 2026

CISA due date

—

The record

The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.

Affected packages

Ecosystem	Package	Introduced	Fixed