CyberSecBulletin

Dplugins vulnerabilities

We track 2 vulnerabilities in Dplugins products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 2, 2026.

2vulnerabilities
1critical
1high
0exploited
9.3average CVSS score

Latest Dplugins vulnerabilities

  • 9.8 Critical severity

    DevKit Pro: Improper Authentication

    CVE-2026-14378Dplugins

    The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the `revert_switch` handler trusting the attacker-controlled `original_user_id` cook

  • 8.8 High severity

    DevKit Pro: Missing Authorization

    CVE-2026-14357Dplugins

    The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEV_install_themes_func() function registered on the wp_ajax_DPD