PT-2026-104073

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the revert switch handler trusting the attacker-controlled original user id cookie as the privileged identity: verify non...

WordPress DevKit Pro plugin <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow vulnerability

Unauthenticated Authentication Bypass to Administrator Account Takeover via 'originaluserid' Cookie in Frontend Revert Switch Flow vulnerability discovered by h0xilo in WordPress Plugin DevKit Pro versions = 2.3.0...