EUVD-2026-69926
GHSA-xppg-27gw-vxcj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessScan for sites running Authorizer ≤3.15.1
-
DeliverySend crafted unauthenticated request
-
ExploitTrigger incorrect privilege assignment
-
ExecutionObtain administrator-level role
-
PersistInstall malicious plugin for code execution
-
ImpactFull site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | Exploitation requires that the target WordPress site has the Authorizer plugin installed and active at version 3.15.1 or earlier and that the WordPress instance is network-reachable by the attacker. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special client-side configuration are required, so against a default-configured vulnerable install this is remote and unauthenticated. The primary limiting factor is deployment scope - Authorizer is a niche SSO plugin, so exposure is confined to the subset of WordPress sites that run it; the exact triggering endpoint/feature is not detailed in the available Patchstack summary and should be confirmed against the advisory. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) describes a maximally severe, network-reachable, unauthenticated, no-interaction flaw with full confidentiality/integrity/availability impact - the profile of a highly attractive target for opportunistic scanning against internet-facing WordPress sites. That said, several corroborating signals are absent from the input: there is no EPSS score, no CISA KEV listing, and no evidence of a published proof-of-concept, so exploitation is currently a modeled expectation rather than an observed fact. Reporting comes from a single source (Patchstack), which raises confidence in the vulnerability's existence but not in exploit maturity. Given the ease of exploitation implied by the vector, defenders - from large hosting providers down to a mid-sized municipal IT team running a handful of WordPress sites - should treat an unauthenticated privilege-escalation flaw in an authentication plugin as urgent and patch promptly, while recognizing the real-world blast radius is bounded by the plugin's relatively narrow deployment footprint. |
| Exploit ScenarioDerived | An attacker scans for internet-facing WordPress sites running the Authorizer plugin and sends a crafted unauthenticated request to the plugin's authorization logic, causing the server to assign the attacker an elevated (e.g., administrator-level) role. With that role the attacker installs a malicious plugin or theme to gain code execution and full site takeover. No public exploit is identified at time of analysis, but the low-complexity, no-authentication vector makes weaponization straightforward if details are published. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Unauthenticated privilege escalation in the WordPress Authorizer plugin (versions 3.15.1 and earlier) lets remote attackers with no credentials elevate themselves to elevated/administrative roles, according to a CVSS 9.8 rating and CWE-266 (incorrect privilege assignment). Authorizer is an authentication/SSO plugin, so a flaw in its role-assignment logic effectively hands attackers control of the authentication gate itself. No public exploit identified at time of analysis, and the issue is reported by Patchstack rather than listed in CISA KEV.
RemediationAI
No vendor-released patched version is identified in the available data; the fix is expected in a release later than 3.15.1, so administrators should upgrade to the latest available Authorizer release once published and confirmed via the plugin changelog and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/authorizer/vulnerability/wordpress-authorizer-plugin-3-15-1-privilege-escalation-vulnerability). Until a confirmed fixed version is applied, compensating controls include deactivating the Authorizer plugin if the site can fall back to native WordPress authentication (trade-off: breaks external SSO login for legitimate users), placing the site behind a WAF with rules to block anomalous registration/role-assignment requests, restricting wp-admin and authentication endpoints to trusted IP ranges (trade-off: hampers remote administrators and federated users), and auditing the site's user table for unexpected administrator/elevated accounts created before or after patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Authorizer is a WordPress plugin (CPE cpe:2.3:a:paul_ryan:authorizer) that governs who may log into and access a WordPress site, typically integrating external identity sources such as LDAP, Google, CAS, or OAuth for institutional/education environments. CWE-266 (Incorrect Privilege Assignment) indicates the plugin grants a user a privilege level higher than intended - here, an unauthenticated request path results in the caller receiving elevated capabilities. Because the vulnerable component is the authorization/role-mapping layer, the defect subverts the very mechanism that is supposed to enforce least privilege, rather than a single feature endpoint.
Know when Authorizer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable escalation to an administrative role yields full C/I/A impact with no privileges or interaction, matching the 9.8 profile.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.
Executive ViewAI
WordPress Authorizer plugin (versions 3.15.1 and earlier) enables attackers to elevate themselves to administrative privileges without authentication, granting complete control over website access controls and user management. This directly compromises any organization using this plugin for employee or customer authentication.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable plugin entirely as preferred option; (2) If unavoidable, implement WAF rules to restrict plugin authentication endpoints; (3) Enable comprehensive audit logging for administrative access and privilege changes; (4) Require multi-factor authentication at the WordPress administrative level; (5) Segment administrative networks and monitor for unauthorized access attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB