The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user specified in a request, allowing any logged‑in user to impersonate any other user, including administrators. This flaw permits an attacker to obtain sensitive account details, take over the target account, and compromise the integrity and confidentiality of the site. The weakness is an authorization bypass, reflected by CWE‑269.

This issue appears in all WordPress installations that the FooSales plugin with a version lower than 1.43.3. Any site that has not upgraded to 1.43.3 or newer is susceptible, regardless of the site’s user base or configuration.

The flaw scores a CVSS of 8.8, indicating high severity. Even with an EPSS of less than 1%, the lack of access controls means a credentialed attacker can easily structure the required requests, so the likelihood of exploitation remains significant once an account is compromised. The vulnerability is not listed in CISA’s KEV catalog, but the difficulty of the attack is low, making it a priority for remediation.