Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-14378 – Unauthenticated Authentication Bypass to Administrator Account Takeover – DevKit Pr

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-14378 is a critical authentication bypass vulnerability in the DevKit Pro plugin for WordPress (by dplugins), affecting all versions through 2.3.0. The flaw resides in the plugin’s "revert switch" user-switching feature, which trusts an attacker-controlled cookie value as proof of a privileged identity, allowing a completely unauthenticated attacker to gain full WordPress administrator access. The issue is rated CRITICAL with a CVSS v3.1 base score of 9.8.

Technical details

  • Root cause: The plugin’s revert-switch handler, part of its "switch user and back" functionality, performs improper nonce and capability verification before restoring a user’s prior session.
  • Trigger condition: The handler relies on the client-supplied original_user_id cookie to determine which account to restore/authenticate as, rather than validating this value against a trusted, server-side session record.
  • Attack vector: A remote, unauthenticated attacker can set the original_user_id cookie to the user ID of an administrator, combine it with a nonce value that is publicly rendered in page markup, and submit a crafted request to the revert-switch endpoint to establish an authenticated administrator session.
  • Impact: Successful exploitation grants full administrator-level access to the WordPress site, enabling complete site takeover — including the ability to install malicious plugins/themes, modify content, create additional privileged accounts, and achieve remote code execution through standard WordPress admin functionality.
  • Privileges/interaction required: None — the attack requires no prior authentication and no victim interaction (AV:N/AC:L/PR:N/UI:N).

Affected software

  • DevKit Pro (WordPress plugin by dplugins) — all versions from the earliest release through 2.3.0, inclusive.

Severity

  • CVSS v3.1 Base Score: 9.8 (Critical)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CWE-287: Improper Authentication

Mitigation and recommended actions

  • Immediate: Update DevKit Pro to the latest available release beyond version 2.3.0. The vendor has published updated versions of the plugin through its official changelog since this issue was reported; confirm the installed version is current and that the revert-switch/user-switch feature has been updated.
  • If immediate patching is not possible:
    • Deactivate the DevKit Pro plugin until it can be updated, since this is a developer/admin utility plugin not required for site front-end operation.
    • Audit WordPress administrator accounts for any unrecognized or newly created users, and review recent admin-level actions (plugin/theme installs, file edits) for signs of compromise.
    • Rotate WordPress authentication keys/salts and force logout of all sessions if compromise is suspected.
    • Restrict or monitor access to WordPress admin endpoints (e.g., via a web application firewall) as a compensating control while patching is scheduled.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge