{"schema":"threatline.record/2","record":{"id":"CVE-2026-14378","aliases":[],"summary":"DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow","details":"The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the `revert_switch` handler trusting the attacker-controlled `original_user_id` cookie as the privileged identity: `verify_nonce_and_capability()` incorrectly checks the `manage_options` capability on the user identified by the cookie rather than on the actual requester via `current_user_can()`, while the switch-back form and a valid session-bound nonce are emitted publicly via `wp_footer` to any visitor — including unauthenticated users — whenever that cookie is present. This makes it possible for unauthenticated attackers to set the `original_user_id` cookie to any administrator's user ID, collect the rendered nonce, and POST it back to the `revert_switch` handler, causing `wp_set_auth_cookie()` to be called with the administrator's ID and granting the attacker a full administrator-level authenticated session and complete site takeover.","categories":["Unclassified"],"product":"DevKit Pro","vendor":"dplugins","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-14378","source_modified_at":"2026-10-03T15:42:51.202Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"DevKit Pro","vendor":"dplugins","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.3.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":9.8,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00479,"percentile":0.40398,"score_date":"2026-10-23"},"published_at":"2026-10-02T03:38:46.144Z","modified_at":"2026-10-03T15:42:51.202Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-14378","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-03T15:42:51.202Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-14378","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ab3986a-69e0-442f-8e79-35b1bc5376d9?source=cve"},{"source":"CVE List","url":"https://docs.dplugins.com/devkit/changelog"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","assessed_at":"2026-10-03T15:31:27.786424Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-03T15:42:51.202Z","content_hash":"c42f7cccbcfd940f9824f29ab0e2c3f7745bdda86de6f5b18f89d18d3746e10b"}}