DevKit Pro vulnerabilities

2 known vulnerabilities in DevKit Pro from Dplugins. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  DevKit Pro: Improper Authentication

  CVE-2026-14378Oct 2, 2026Dplugins

  The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the `revert_switch` handler trusting the attacker-controlled `original_user_id` cook

• 8.8 High severity

  DevKit Pro: Missing Authorization

  CVE-2026-14357Sep 2, 2026Dplugins

  The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEV_install_themes_func() function registered on the wp_ajax_DPD