The DevKit Pro WordPress plugin contains an authentication bypass that lets an unauthenticated user set a cookie named original_user_id to any administrator’s user ID. The plugin’s revert_switch handler then uses this cookie value to verify the user’s permissions. Because it checks the manage_options capability on the cookie‑identified user instead of on the actual requester, an attacker can submit a valid nonce and cause wp_set_auth_cookie() to be invoked with the administrator’s ID, thereby obtaining a full administrator session and complete site takeover.

The vulnerability affects the DevKit Pro plugin from dplugins version 2.3.0 and earlier. WordPress site administrators running any of these plugin releases are at risk.

With a CVSS score of 9.8 this issue is considered critical. The exploit requires the attacker to set a cookie and submit a foreign nonce, which can be achieved by any unauthenticated user with access to the site’s frontend. EPSS information is not available, so the current probability of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, but its severity and the ability to fully compromise a site make it a high‑priority risk that can be leveraged remotely without initial authentication.