Technical impact
The Datawiza Proxy Auth Plugin for WordPress, version 1.1.0 and earlier, fails to verify that the user‑identity and role HTTP request headers originate from a trusted reverse proxy. As a result, an unauthenticated attacker can inject arbitrary X‑User and Role headers, causing the plugin to create and authenticate a user with administrator privileges. This flaw permits full control over the WordPress site by elevating the attacker’s privileges.
Affected Systems
Affected is the Datawiza Proxy Auth Plugin used on WordPress installations. Versions 1.1.0 and below are susceptible; the vulnerability does not affect later releases. The plugin’s vendor is listed as Unknown: Datawiza Proxy Auth Plugin, and no other product versions are stated in the advisory.
Risk and Exploitability
It is a high severity vulnerability with a CVSS score of 9.8, indicating that the flaw allows an attacker to gain administrator privileges without authentication. The EPSS score is less than 1%, implying a low probability of exploitation in time, and the issue is not listed in the CISA KEV catalog. Nevertheless, because the plugin fails to validate the authority of X‑User and Role headers, an unauthenticated attacker can inject these headers, resulting in full control over the WordPress site. The attack requires only unauthenticated HTTP requests with crafted headers, and no additional prerequisites are listed.
