WordPress security by component
authorizer
authorizer is a WordPress plugin with 2 published CVE records in this archive. The latest tracked vulnerability was published Oct 01, 2026; the highest published CVSS base score is 9.8.
Plugin slug:
authorizerLatest vulnerability
CVE-2026-103752: Authorizer: Privilege escalation
Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions. The attacker needs no WordPress login. An attacker can cross an authorization boundary and obtain greater privileges. The target role and escalation operation are not identified. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the precise input-to-operation path cannot be established from this snapshot. The authoritative export identifies the fixed release as 3.16.0.
| Safe version |
|
||
|---|---|---|---|
| Oct 01, 2026 |
CVE-2026-103752
Authorizer: Privilege escalation
Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions. The attacker needs no WordPress login. An attacker can cross an authorization boundary and obtain greater privileges. The target role and escalation operation are not identified. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the precise input-to-operation path cannot be established from this snapshot. The authoritative export identifies the fixed release as 3.16.0.
|
3.16.0 |
CVE9.8
|
| Sep 02, 2026 |
CVE-2026-81294
Authorizer permits unauthenticated privilege escalation
Authorizer through 3.15.1 permits an unauthenticated attacker to cross the plugin's authorization boundary and gain elevated WordPress privileges. The affected operation and resulting role are not specified in the authoritative export.
|
3.15.2 |
CVE9.8
|