CVE-2026-14378

Published 2 October 2026 · tracked since 2 October 2026

Description

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the `revert_switch` handler trusting the attacker-controlled `original_user_id` cookie as the privileged identity: `verify_n

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-104606 MEDIUM 6.3
• CVE-2026-94541 CRITICAL 9.8
• CVE-2026-87920 HIGH 7.2
• CVE-2026-103552 HIGH 7.3
• CVE-2026-97663 HIGH 7.2
• CVE-2026-97338 MEDIUM 6.4
• CVE-2026-97342 HIGH 7.2
• CVE-2026-97634 MEDIUM 6.5
• CVE-2026-97637 CRITICAL 9.8
• CVE-2026-97641 HIGH 7.2

→ Open the live CVE board · all tools