This flaw allows unauthenticated users to set a specific cookie named wp_debug_troubleshoot_simulate_user to any numeric user ID, which the plugin accepts without validation and uses to override the current user context. By doing so, an attacker can impersonate any existing user, including those with administrative privileges, and perform privileged actions such as creating new administrators, modifying site content, installing plugins, or taking complete control of the WordPress site.

Vulnerable installations are those that use the jhimross Debugger & Troubleshooter WordPress plugin in versions 1.3.2 and earlier; no other plugins or WordPress core components are affected by this specific vulnerability.

Characterized by a CVSS score of 8.8, the vulnerability is high severity and not listed in CISA's KEV catalog. The exploit does not require authentication or complex preparation, as attackers can set the cookie directly through a browser or HTTP requests. Based on the description it is inferred that the likely attack vector is via cookie manipulation, which can be performed by any visitor to the site. The lack of cryptographic checks and lack of authorization means that the exploit can be carried out with minimal effort and can lead to full site compromise.