CVE-2026-103752
CriticalCVSS 9.8Summary
The Authorizer plugin in versions up to and including 3.15.3 contains an unauthenticated privilege escalation vulnerability.
Risk Assessment
An unauthenticated attacker can elevate their privileges on the WordPress site, potentially leading to full site takeover.
Recommendation
Update the Authorizer plugin to a version later than 3.15.3 that contains the fix.
Other vulnerabilities in Authorizer
See all- CVE-2026-54072Critical
In Authorizer prior to version 2.2.1, the /authorize endpoint accepts any redirect_uri without validating it against AllowedOrigins. With response_type=token or response_type=id_token, the server appends access_token, id_token, and refresh_token as query parameters and issues a 302 redirect to the attacker-supplied URL. An unauthenticated attacker can obtain the client_id from the public /graphql endpoint.
- CVE-2026-81294Critical
Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.
Original NVD description (English source)
Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS