Datawiza Proxy Auth EUVD-2026-109352

The target must be running the Datawiza Proxy Auth Plugin for WordPress at a version in 1.1.0 up to (but not including) 1.1.1, with the plugin's header-based proxy authentication active. Exploitation requires the attacker to send the user-identity and role HTTP headers the plugin trusts and have them reach the plugin - i.e. the deployment must allow externally supplied copies of those headers to arrive at WordPress. The key LIMITING factor is topology: if a correctly configured reverse proxy strips or overwrites these identity/role headers before forwarding, attacker-supplied forged headers would not reach the plugin and would not be honored; the vulnerability is precisely that the plugin itself does not verify the headers came from that trusted proxy. The specific header names and exact request format are not described in the available sources.

Raw severity is maximal: the input CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a network-reachable, low-complexity flaw needing no privileges or user interaction, and because the plugin trusts user-identity and role HTTP headers without verifying they came from the trusted reverse proxy, PR:N is justified - an unauthenticated attacker can mint an administrator. The decision framework agrees on urgency (vuln.today Decision label = act_now) and a fix is available, which argues for prompt patching. However, the signals partly conflict: EPSS is only 0.14% (3rd percentile), there is no CISA KEV listing (not actively exploited per that source), and the PoC is a WPScan reference not verified as working exploit code - so this is high-severity-with-trivial-mechanics but not yet evidence of widespread active exploitation. Real-world risk is further bounded by deployment footprint: the Datawiza Proxy Auth Plugin is a niche identity/reverse-proxy integration plugin, not a ubiquitous component, so exposure is limited to the specific sites running it. Net: treat as a genuine act_now priority for any site running the affected plugin (full takeover with no auth), but the low EPSS and absence of KEV suggest the overall internet-wide exploitation volume is currently low rather than mass-scanned.

An attacker sends a crafted HTTP request directly to a WordPress site running the vulnerable Datawiza Proxy Auth Plugin, injecting the user-identity and role headers the plugin trusts; because the plugin never confirms those headers originated from the trusted reverse proxy, the request is authenticated as an administrator and the attacker can create an admin account and take over the site. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this needs only network reach and no authentication or user interaction. A public PoC reference exists via WPScan but it is not verified as working exploit code.