Unverified Proxy Headers Enable Admin Impersonation

The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Datawiza Proxy Auth Plugin for WordPress contains a critical authentication bypass vulnerability (CVE-2026-115214, CVSS 9.8) that allows unauthenticated attackers to assume administrator privileges. The plugin trusts user-identity and role HTTP headers without verifying they originate from a legitimate reverse proxy, creating a dangerous assumption that external headers are inherently trustworthy. This affects any WordPress installation using Datawiza versions before 1.1.1 that rely on this plugin for authentication delegation. An attacker can forge these headers in direct requests to the WordPress server, bypassing all authentication mechanisms and gaining full administrative access—one of the most damaging outcomes possible for a content management system.

Casky's 224 mapped skills detect this vulnerability pattern through Claude's analysis of CWE-269 (Improper Authentication) and MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky would identify suspicious authentication flows where privilege elevation occurs without credential validation, header manipulation attempts from unexpected network sources, and sudden administrative account creation or access from anomalous origins. The platform's extended reasoning capabilities correlate multiple indicators: authentication decisions based on unvalidated HTTP headers, absence of proxy origin verification checks in code paths, and privilege escalation without corresponding login events in authentication logs. These findings surface the exact pattern—trusting headers that should be cryptographically verified or validated against a proxy allowlist—enabling teams to remediate before exploitation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-115214.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-115214

Casky has 224 skills that investigate the attack patterns behind CVE-2026-115214. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn