The Customer Switching WordPress plugin, when running a version earlier than 2.1.3, fails to securely bind an active user‑switching session to the operator who initiated it. This flaw allows a lower‑privileged account that the operator is switched into to be resolved as that operator and consequently switch into any allowed account, including an administrator. The result is a full account takeover, giving the attacker all the privileges of the targeted account.

This vulnerability affects installations of the Customer Switching plugin for WooCommerce on WordPress sites. Versions prior to 2.1.3 are impacted. The plugin is used to switch between customer accounts, and the defect applies to any site where the plugin is active and the switching feature is enabled.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via a publicly accessible WordPress site that has the vulnerable plugin installed. An attacker could trigger the insecure operator resolution by initiating or manipulating a session switch and then resolve that session to gain administrator privileges.