blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-15240

HIGH 7.5 CVSS 3.1
Published
July 30, 2026
Last modified
July 30, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-287
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account, including an administrator, resulting in full account takeover.

Affected products and versions

  • Unknown Customer Switching — Before 2.1.3

References

  • wpscan.com https://wpscan.com/vulnerability/4e5b9e2a-c8e0-41db-a989-1b44bc76c9d8/
  • nvd.nist.gov Official NVD record