CVE-2026-115214

{
  "etk_id": "ETK-2026-2587",
  "cve_id": "CVE-2026-115214",
  "display_id": "CVE-2026-115214",
  "ghsa_id": "GHSA-h3j8-jgx9-4qjv",
  "euvd_id": "EUVD-2026-109352",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Header-based authentication bypass in Datawiza Proxy Auth Plugin",
  "summary": "Datawiza Proxy Auth Plugin for WordPress versions before 1.1.1 can accept identity and role information from untrusted request headers. An unauthenticated remote attacker may use this to obtain WordPress administrator access when requests can reach the plugin without those headers being restricted to a trusted reverse proxy.",
  "mitigation": "Upgrade Datawiza Proxy Auth Plugin to version 1.1.1 or later. Configure the public-facing proxy to remove client-supplied identity and role headers, and allow such headers to reach WordPress only from the trusted proxy.",
  "vendor": null,
  "product": "Datawiza Proxy Auth Plugin",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.1.0, < 1.1.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.1.1"
      ],
      "package_name": "Datawiza Proxy Auth Plugin",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 29.318341766666666,
  "t0_at": "2026-10-25T06:00:22.035000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-25T08:54:16.210571+00:00",
      "days": 0.12076592096064814,
      "is_lower_bound": false,
      "measured_at": "2026-10-25T06:00:22.035000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-25T06:00:22.035000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-25T06:00:22.035000+00:00",
      "url": "https://github.com/advisories/GHSA-h3j8-jgx9-4qjv"
    }
  }
}