SECURITYCRITICALCVE-2026-81294

Unauthenticated Privilege Escalation in Authorizer ≤ 3.15.1

CVE-2026-81294 (CVSS 9.8) lets unauthenticated attackers gain elevated privileges in the Authorizer WordPress login/SSO plugin.

Dylan H.

Security Team

September 3, 2026
3 min read
Unauthenticated Privilege Escalation in Authorizer ≤ 3.15.1

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Authorizer (WordPress plugin, by Paul Ryan) ≤ 3.15.1

Executive Summary

A critical unauthenticated privilege escalation vulnerability, tracked as CVE-2026-81294, has been disclosed in Authorizer — a WordPress plugin by Paul Ryan that provides Google/OAuth, CAS, LDAP, and email-based authentication for WordPress sites — affecting versions 3.15.1 and earlier. The flaw was published on September 2, 2026, and carries a CVSS v3.1 score of 9.8 (Critical).

CVSS Score: 9.8 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The vulnerability is classified as CWE-266 (Incorrect Privilege Assignment) and requires no authentication and no user interaction. Because Authorizer sits directly in a site's login and role-assignment flow, an incorrect privilege assignment bug in this plugin gives a remote, unauthenticated attacker a direct path to gaining elevated — potentially administrator-level — access on any affected site.

Vulnerability Overview

AttributeValue
CVE IDCVE-2026-81294
CWECWE-266 (Incorrect Privilege Assignment)
CVSS Score9.8 (Critical)
TypeUnauthenticated Privilege Escalation
Attack VectorNetwork (no authentication required)
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
AssignerPatchstack
Related IDGHSA-xppg-27gw-vxcj

Affected Versions

PluginAffected VersionsFixed Version
Authorizer (Paul Ryan)≤ 3.15.1Not yet published at time of writing

No confirmed patched release number is publicly listed yet. Treat any release above 3.15.1 as the presumed fix and confirm against the official WordPress.org plugin page once available.

Why This Matters

Authorizer is designed to sit in front of WordPress's native login system, controlling which external-identity users (Google, LDAP, CAS, email-approved) are granted access and at what role level. A privilege-assignment flaw in an authentication gatekeeper plugin is uniquely dangerous because:

  • It requires no valid credentials — the vulnerability is exploitable by an anonymous, unauthenticated actor.
  • A successful exploit can grant full impact across confidentiality, integrity, and availability (CVSS C:H/I:H/A:H), consistent with an attacker landing an administrator-equivalent role.
  • Sites using Authorizer for SSO or external identity federation are especially exposed, since the plugin is the trust boundary deciding who gets elevated access.

Recommended Actions

  1. Identify affected installs — check the plugin version under Plugins > Installed Plugins > Authorizer or via wp plugin get authorizer --field=version.
  2. Update immediately once a fixed release above 3.15.1 ships.
  3. Audit user role changes in wp_usermeta/wp_capabilities for any unexpected escalations to administrator since the disclosure date.
  4. Review Authorizer's external-authentication logs for anomalous login attempts, especially from unrecognized OAuth/LDAP/CAS identities.
  5. If patching isn't immediately possible, consider disabling Authorizer's external authentication providers temporarily and falling back to WordPress-native login with strong passwords + MFA via another plugin.
  6. Rotate administrator credentials if any unauthorized privilege change is found.

References

Related Reading