The Account Switcher plugin for WordPress contains an authentication bypass in its rememberLogin REST endpoint. The comparison operator used for validating the secret is loose (!=) instead of strict (!==) and the plugin does not enforce that the secret is non‑empty. When a target user who has never used the "Remember me" feature is addressed, the asSecret user meta is empty, causing the comparison to evaluate incorrectly. The endpoint then calls wp_set_auth_cookie() for that user, allowing the attacker to assume the user’s identity. All REST routes expose the permission_callback => '__return_true', allowing any authenticated user with a Subscriber role or higher to trigger the abuse, which ultimately permits escalation to Administrator privileges.

The vulnerability impacts all installations of the Account Switcher plugin from beycanpress that are running version 1.0.2 or older. It is present on any WordPress site that has this plugin installed and exposes its REST API endpoints.

The CVSS score of 8.8 reflects the high severity of this privilege escalation. EPSS data is not available and the issue is not listed in CISA’s KEV catalog. Exploitation requires only that the attacker have an authenticated account with Subscriber level access or higher—a common situation on many WordPress deployments. By sending a crafted REST request with an empty secret to the rememberLogin endpoint, an attacker can obtain a valid authentication cookie for any target user without further credentials. The lack of capability checks makes the attack trivial once authentication is achieved.