Description

WordPress Plugin Login as User or Customer is prone to a privilege escalation vulnerability. Exploiting this issue may allow attackers to bypass the expected capabilities check and perform otherwise restricted actions; other attacks are also possible. WordPress Plugin Login as User or Customer version 3.2 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 3.3 or latest

References

https://sploitus.com/exploit?id=WPEX-ID:286D972D-7BDA-455C-A226-FD9CE5F925BD

https://plugins.svn.wordpress.org/login-as-customer-or-user/trunk/readme.txt

Related Vulnerabilities

Collabtive Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-3298)

Passster-Password Protection Security Bypass (3.5.5.8)

PHP Numeric Errors Vulnerability (CVE-2015-2331)

amtyThumb posts Cross-Site Scripting (8.1.3)

Ultimate Member-User Profile, Registration, Login, Member Directory, Content Restriction & Membership Open Redirect (2.1.6)

Severity

High

Classification

CVE-2022-4305 CWE-269 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Privilege Escalation