Unauthenticated Privilege Escalation in Authorizer ≤ 3.15.1

Executive Summary

A critical unauthenticated privilege escalation vulnerability, tracked as CVE-2026-81294, has been disclosed in Authorizer — a WordPress plugin by Paul Ryan that provides Google/OAuth, CAS, LDAP, and email-based authentication for WordPress sites — affecting versions 3.15.1 and earlier. The flaw was published on September 2, 2026, and carries a CVSS v3.1 score of 9.8 (Critical).

CVSS Score: 9.8 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The vulnerability is classified as CWE-266 (Incorrect Privilege Assignment) and requires no authentication and no user interaction. Because Authorizer sits directly in a site's login and role-assignment flow, an incorrect privilege assignment bug in this plugin gives a remote, unauthenticated attacker a direct path to gaining elevated — potentially administrator-level — access on any affected site.

Vulnerability Overview

Affected Versions

No confirmed patched release number is publicly listed yet. Treat any release above 3.15.1 as the presumed fix and confirm against the official WordPress.org plugin page once available.

Why This Matters

Authorizer is designed to sit in front of WordPress's native login system, controlling which external-identity users (Google, LDAP, CAS, email-approved) are granted access and at what role level. A privilege-assignment flaw in an authentication gatekeeper plugin is uniquely dangerous because:

• It requires no valid credentials — the vulnerability is exploitable by an anonymous, unauthenticated actor.
• A successful exploit can grant full impact across confidentiality, integrity, and availability (CVSS C:H/I:H/A:H), consistent with an attacker landing an administrator-equivalent role.
• Sites using Authorizer for SSO or external identity federation are especially exposed, since the plugin is the trust boundary deciding who gets elevated access.

Recommended Actions

1. Identify affected installs — check the plugin version under Plugins > Installed Plugins > Authorizer or via wp plugin get authorizer --field=version.
2. Update immediately once a fixed release above 3.15.1 ships.
3. Audit user role changes in wp_usermeta/wp_capabilities for any unexpected escalations to administrator since the disclosure date.
4. Review Authorizer's external-authentication logs for anomalous login attempts, especially from unrecognized OAuth/LDAP/CAS identities.
5. If patching isn't immediately possible, consider disabling Authorizer's external authentication providers temporarily and falling back to WordPress-native login with strong passwords + MFA via another plugin.
6. Rotate administrator credentials if any unauthorized privilege change is found.

References

• NVD — CVE-2026-81294
• OffSeq Threat Radar — CVE-2026-81294
• GitHub Security Advisory — GHSA-xppg-27gw-vxcj

Related Reading

• Unauthenticated SQL Injection in WCFM Marketplace ≤ 3.8.1
• Critical Auth Bypass in Tutor LMS Pro Exposes 30,000+
• WordPress Plugin Vulnerability (CVSS 10.0) Under Active