VulnerabilityModified
CVE-2022-4305
The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.
CRITICAL 9.8EPSS 38.6%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 38.6%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 38.63% probability · 98th percentile
- CISA KEV
- Not listed
- Affected
- wp-buy/login as user or customer \(user switching\)
- Source
- contact@wpscan.com
References
- https://wpscan.com/vulnerability/286d972d-7bda-455c-a226-fd9ce5f925bdExploit, Third Party Advisory
- https://wpscan.com/vulnerability/286d972d-7bda-455c-a226-fd9ce5f925bdExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.