The WP User Switch plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.2. This is due to incorrect authentication checking in the 'wpus_allow_user_to_admin_bar_menu' function with the 'wpus_who_switch' cookie value. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator, if they have access to the username.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2023-06-06T01:55:07.908Z
Updated: 2024-08-02T06:26:09.731Z
Reserved: 2023-05-05T17:11:57.789Z
Link: CVE-2023-2546
Vulnrichment
No data.
NVD
Status : Modified
Published: 2023-06-06T02:15:09.943
Modified: 2023-11-07T04:12:51.690
Link: CVE-2023-2546
Redhat
No data.