| CVE | [CVE-2026-81294]( · [CVE.org]( |
| CWE | [CWE-266]( |
| CVSS | **Critical: 9.8** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |
| Product | WordPress — [Authorizer]( |
| Affected | all versions **through 3.15.1** (inclusive) |
| License | [GNU Affero GPL v3.0](LICENSE) |
| Lab | `127.0.0.1` only · vendor/client disclosure pack, not a scanner |
GitHub emails[] without verified is the disclosed sink. Lab is generic OAuth2 with the same missing email_verified check. HTTP is GET wp-login.php?external=oauth2.
- **Path:** `/wp-login.php?external=oauth2`
- **Router:** authenticate filter custom_authenticate_oauth2. 3.15.1 GitHub emails API mapped entry.email without checking entry.verified. Lab uses generic OAuth2 with the same missing verification. 3.15.2 filters empty(entry.verified) for GitHub and adds oauth2_require_verified_email for generic.
- **Notes:** CVE-2026-81294 CWE-266 Authorizer 3.15.1. Unauthenticated priv-esc via unverified OAuth2 email matching an admin. Witness POCWitness81294. Patched 3.15.2.
- `GET /wp-login.php?external=oauth2 (keep PHPSESSID)`
- `302 /oauth-mock/authorize then 302 back with code+state`
- `WP exchanges token, userinfo [email protected] unverified`
- `get_user_by email admin, wp_set_auth_cookie`
- admin email [email protected] display_name=POCWitness81294
GET /?auth_lab=1 after OAuth is POCWitness81294. Login page HTML without that string is not it.
**Do this first:** Update **Authorizer** to **3.15.2 or newer**.
- Re-run `CVE-2026-81294-Abraxas-Labs.py` against the patched build: the mapped witness must **not** appear.
- Confirm the vendor advisory / changeset in the deployed tree (see references).
- Disable or isolate the affected component.
- Hunt for the witness condition on production (new privileged users, unexpected files, injected rows — whatever this CVE's map names).
Target **only** ` (or the loopback you bound). Do not point this script at the internet.
Success is the **witness** above in the response body. Generic 200 HTML is not it.
Loopback stack used to reproduce. Official images unless a `Dockerfile` in this folder builds from source.
- [`lab/docker-compose.yml`](lab/docker-compose.yml)
- [`lab/docker-compose.override.yml`](lab/docker-compose.override.yml)
Bind the vulnerable product tree to Compose if the YAML mounts a local directory (plugin zip / source tag from the version table). Publish nothing except `127.0.0.1`.
- [CVE-2026-81294 · NVD](
- [CVE-2026-81294 · CVE.org](
- [patchstack.com/database/wordpress/plugin/authorizer/vulnerability/wordpress-authorizer-plugin-3-15-1-privilege-escalation-vulnerability?_s_id=cve](
- [github.com/advisories/GHSA-xppg-27gw-vxcj](
- [nvd.nist.gov/vuln/detail/CVE-2026-81294](
- Plugin directory: [authorizer](
- Trac browser: [plugins.trac.wordpress.org/authorizer](
- SVN tags: [plugins.svn.wordpress.org/authorizer](
- Abraxas Labs: [abraxaslabs.tech]( · [github.com/abraxas]( · [@abraxas_null](
- input: `
Unauthenticated Privilege Escalation in Authorizer
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
