The Fast User Switching plugin contains a missing CSRF check that permits an attacker to induce an authenticated user to switch to another account without authorisation. Once the switch is forced, the attacker can perform actions as that account, enabling abuse of user permissions and access to protected content. This vulnerability maps to CWE‑352, a standard CSRF flaw.

WordPress installations that include the Fast User Switching plugin from Tikweb Management, version 1.4.10 or earlier, are vulnerable. The issue applies to all instances where the plugin is active, regardless of the site's role or configuration.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low exploitation probability at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would require the victim to visit a malicious link or a page that submits a forged form to the plugin’s user‑switching endpoint without a valid CSRF token, after the victim is already authenticated to the target WordPress site.