EUVD-2026-91165
GHSA-xwfv-9j83-wfj7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSet original_user_id cookie to admin ID
-
DeliveryLoad front-end page rendering switch-back form
-
ExploitHarvest session-bound nonce from wp_footer
-
ExecutionPOST nonce to revert_switch handler
-
Persistwp_set_auth_cookie() issues admin session
-
ImpactFull administrator site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the DevKit Pro plugin (version <=2.3.0) be installed and active, and specifically that the user-switching / revert-switch feature path be reachable such that the switch-back form and session-bound nonce are emitted via wp_footer when the original_user_id cookie is set - the attacker supplies that cookie, so this is self-triggerable. The only real limiting factor is the attacker needing a valid target administrator user ID (frequently ID 1 by default) and that the plugin's revert_switch handler is registered on front-end requests. There is no authentication, user-interaction, or non-default configuration barrier (AV:N/AC:L/PR:N/UI:N) against a default install of the affected plugin. |
| Impact | This is a genuine high-priority vulnerability, not an inflated CVSS score. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) is fully consistent with the technical description: the flaw is remotely reachable over HTTP, requires no authentication (PR:N), no user interaction (UI:N), and low complexity because the switch-back form and a valid session-bound nonce are rendered publicly via wp_footer to any visitor whenever the original_user_id cookie is present. The logic error - verify_nonce_and_capability() checking manage_options against the cookie-supplied user ID rather than the actual requester via current_user_can() - makes exploitation deterministic rather than probabilistic, so the C:H/I:H/A:H (full admin takeover) impact is credible. No EPSS score, CISA KEV entry, or public POC is present in the provided data, so there is no evidence of active exploitation yet; however, Wordfence (the reporting source and a credible WordPress threat-intel vendor) classifying this as an unauthenticated admin-takeover auth bypass means weaponization risk is high once details circulate. Note the absence of an explicit patched version in the input - the description states 'all versions up to, and including, 2.3.0' are vulnerable but does not confirm a fixed release; verify the fix via the dplugins changelog reference before remediation planning. |
| Exploit ScenarioDerived | An unauthenticated attacker sets the original_user_id cookie to a known or guessed administrator user ID (commonly 1), then loads any front-end page where the plugin renders the switch-back form and its session-bound nonce in the footer. The attacker harvests that nonce and POSTs it to the revert_switch handler, causing wp_set_auth_cookie() to issue a valid authenticated session as that administrator, resulting in complete site takeover. No public POC is identified in the provided data, but the attack is low-complexity and fully remote. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Unauthenticated attackers can obtain a full administrator session on any WordPress site running the DevKit Pro plugin at version 2.3.0 or earlier by setting an attacker-controlled original_user_id cookie to a known administrator's user ID, harvesting the switch-back nonce the plugin renders publicly in the site footer for any visitor carrying that cookie, and POSTing it to the plugin's revert_switch handler. The root cause is a privilege-check logic error rather than a memory-safety bug: the handler's verify_nonce_and_capability() routine checks the manage_options capability against the user named in the attacker-supplied cookie instead of against the actual requester, so the subsequent wp_set_auth_cookie() call mints an authenticated session for the impersonated administrator, resulting in complete site takeover. Our independent assessment confirms the 9.8 CVSS (AV:N/AC:L/PR:N/UI:N) is genuine and not inflated: exploitation needs only a default install of the affected plugin (version 2.3.0 or lower) with the front-end revert path reachable and a valid administrator user ID such as the default ID 1, with no authentication, user interaction, or non-default configuration barrier; no public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV).
RemediationAI
Patch status: patch available per vendor advisory - the vendor changelog at https://docs.dplugins.com/devkit/changelog documents the fix, and because the vulnerable range explicitly ends at 2.3.0 the fixed release is expected to be later than 2.3.0; the exact fixed version number is not stated in the provided data, so confirm the version in that changelog before deploying. The primary remediation is to update DevKit Pro to the vendor-fixed release and, if the plugin is not required, deactivate and delete it entirely (trade-off: loss of the user-switching and other DevKit Pro functionality, but the smallest possible attack surface). If the plugin must remain in place before an upgrade can be scheduled, apply specific compensating controls: unhook or block the revert_switch handler and the corresponding wp_footer switch-back form output with a small site-specific mu-plugin, which neutralizes the attack path at the cost of disabling the plugin's user-switching feature; alternatively place a WAF or reverse-proxy rule that rejects front-end POST requests carrying an original_user_id cookie or targeting the plugin's revert action, accepting that legitimate administrator use of the switching feature will also be blocked. As a hardening measure, avoid exposing a predictable default administrator account ID such as ID 1 and prefer non-enumerable admin usernames, though this only raises the effort of the reconnaissance step and is not a substitute for the fix. Because exploitation grants a valid administrator session, treating the site as potentially compromised is warranted: after patching, rotate the WordPress authentication salts/keys in wp-config.php to invalidate all existing sessions (all logged-in users will be forced to re-authenticate), reset administrator credentials, review the users list for rogue administrator or elevated accounts created during the exposure window, and audit plugin, theme, and content changes for tampering. Record and monitor for the IOC of requests containing an original_user_id cookie sent to front-end endpoints, and cross-check against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2ab3986a-69e0-442f-8e79-35b1bc5376d9?source=cve for any updated guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
DevKit Pro is a WordPress plugin by dplugins whose user-switching feature allows an operator to temporarily assume another account and then revert_switch back to the original identity. The design stores the original identity in an original_user_id cookie, and the switch-back flow relies on two artifacts: a session-bound nonce and a form emitted through the wp_footer hook. The flaw maps to CWE-287 (Improper Authentication): instead of resolving the requester with current_user_can() and checking manage_options against the live WordPress session, verify_nonce_and_capability() dereferences the user ID from the client-supplied cookie and performs the capability check against that record. Because the cookie is fully attacker-controlled, the attacker selects the target principal - any administrator, most commonly user ID 1 - and the plugin then treats that principal as the beneficiary of the request. Compounding the issue, the switch-back form and a valid, session-bound nonce are printed publicly via wp_footer to every visitor whenever the cookie is present, so an unauthenticated attacker with no session of their own can self-trigger the nonce rendering, read the nonce from the HTML response, and replay it to the revert_switch handler. Successful execution reaches wp_set_auth_cookie() with the administrator's ID, producing a legitimate WordPress auth cookie set for the administrator account and hence full administrative control of the site (install plugins/themes, create rogue admins, exfiltrate data). The CPE cpe:2.3:a:dplugins:devkit_pro:*:*:*:*:*:*:*:* confirms the affected component is the DevKit Pro plugin distributed by dplugins rather than WordPress core; no companion server, protocol, or library is implicated, and the attack surface is purely the plugin's front-end reachable handling of the original_user_id cookie.
Know when Devkit Pro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated attacker supplies cookie and self-serves the public nonce, so AV:N/AC:L/PR:N/UI:N; resulting admin session yields full C:H/I:H/A:H on the same site (S:U).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the revert_switch handler trusting the attacker-controlled original_user_id cookie as the privileged identity: verify_nonce_and_capability() incorrectly checks the manage_options capability on the user identified by the cookie rather than on the actual requester via current_user_can(), while the switch-back form and a valid session-bound nonce are emitted publicly via wp_footer to any visitor - including unauthenticated users - whenever that cookie is present. This makes it possible for unauthenticated attackers to set the original_user_id cookie to any administrator's user ID, collect the rendered nonce, and POST it back to the revert_switch handler, causing wp_set_auth_cookie() to be called with the administrator's ID and granting the attacker a full administrator-level authenticated session and complete site takeover.
Executive ViewAI
Every WordPress site running the DevKit Pro plugin at version 2.3.0 or earlier can be taken over completely by an unauthenticated attacker, with no credentials, user interaction, or prior access required. Because the flaw yields a full administrator session, an attacker could seize control of site content, install malicious code, and pivot to any data or integrations the site touches - meaning any business unit, customer, or partner relying on an affected web property is exposed. With no vendor fix currently available, this represents an unmitigated, high-urgency risk that demands immediate compensating action rather than a routine patch cycle.
No vendor-released patch identified at time of analysis. Interim mitigations: take affected sites offline or place them in maintenance mode; deactivate and uninstall DevKit Pro 2.3.0 or earlier where operationally possible; block or strip the original_user_id cookie and deny POST requests to the plugin's revert_switch handler at the WAF, reverse proxy, or edge; restrict wp-admin and wp-login access by IP allowlist; rotate WordPress authentication salts and all administrator credentials; and monitor logs for anomalous administrator session creation or privilege changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB