Description
The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Login as User or Customer | < 3.3 | 3.3 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Login as User or Customer < 3.3 - Privilege Escalation http/cves/2022/CVE-2022-4305.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://wpscan.com/vulnerability/286d972d-7bda-455c-a226-fd9ce5f925bd exploit vdb-entry technical-description