The Browse As plugin for WordPress, versions up to and including 0.2, contains an authentication bypass flaw caused by improper validation of the is_ba_original_user_COOKIEHASH cookie within the IS_BA_Browse_As::notice function. This flaw permits any user who can authenticate as a subscriber or higher to assume the identity of any other user on the same site if they know the target’s user ID. The result is unauthorized access to content and functions, potentially including administrative privileges, violating confidentiality and integrity.

This vulnerability affects the Browse As plugin (author sorich87) installed on WordPress sites. All installations running version 0.2 or earlier are impacted; no later releases have been identified as vulnerable. Site administrators should verify the current plugin version, as the issue is tied to the plugin code rather than WordPress core.

The CVSS v3 score of 8.8 labels it as high severity, reflecting the heavy impact of impersonation. However, the EPSS score of less than 1% indicates that real‑world exploitation is currently unlikely, and the flaw is not listed in the CISA KEV catalog. The attack requires that the adversary already possess at least subscriber-level credentials on the target site; once authentic, they can manipulate the cookie to target any user ID, thereby bypassing all role‑based access controls.