Description

The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.

Related CPE's

a

wp-buy

login_as_user_or_customer_\(user_switching\)

*

*

*

*

*

wordpress

Vulnerable

References

https://wpscan.com/vulnerability/286d972d-7bda-455c-a226-fd9ce5f925bd

ExploitThird Party Advisory

https://wpscan.com/vulnerability/286d972d-7bda-455c-a226-fd9ce5f925bd

ExploitThird Party Advisory

Weaknesses

Could not find any weaknesses

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 · Critical

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Modified

Published

2023-01-23T15:15:14.283

2 years ago

Last modified

2025-04-03T20:15:18.120

3 months ago