What is the CVSS score of CVE-2026-15240?

CVE-2026-15240 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Customer Switching are affected by CVE-2026-15240?

The Customer Switching WordPress plugin before version 2.1.3 contains an account takeover vulnerability allowing low-privileged users to escalate to administrator access.. A patch is available.

Is there a public PoC exploit available for CVE-2026-15240?

Yes, a public proof-of-concept exploit is available for CVE-2026-15240. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-15240?

Within 24 hours, inventory all WordPress installations running the Customer Switching plugin and identify systems with versions before 2.1.3; disable the plugin on affected systems as a temporary measure. Within 7 days, update the Customer Switching plugin to version 2.1.3 or later across all installations. Within 30 days, audit all administrator accounts on previously affected systems for unauthorized creation or modification during the vulnerability window, review access logs for suspicious account-switching activity, and implement stricter role-based access controls on low-privileged user capabilities.

Customer Switching CVE-2026-15240

EUVD-2026-50996 HIGH

Improper Authentication (CWE-287)

2026-07-30 WPScan

GHSA-fpgp-7gxr-qx3q

WordPress Authentication Bypass Customer Switching Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

AC:H because it requires an operator to be actively switched into the attacker's account (state beyond attacker control); PR:L for the authenticated low-privileged foothold; full C/I/A from admin takeover.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:32 vuln.today

CVSS changed

Jul 30, 2026 - 15:22 NVD

7.5 (HIGH)

Patch available

Jul 30, 2026 - 07:03 EUVD

CVE Published

Jul 30, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account, including an administrator, resulting in full account takeover.

AnalysisAI

Full account takeover in the Customer Switching WordPress plugin before 2.1.3 allows a low-privileged user, while an operator is actively switched into their account, to be resolved as that operator and switch into any permitted account including an administrator. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.14% (4th percentile) and it is not in CISA KEV; no public exploit identified as actively used at time of analysis.

Technical ContextAI

The plugin implements an operator-initiated 'switch to another account' impersonation feature (similar in concept to the well-known User Switching pattern) on WordPress. The root cause maps to CWE-287 (Improper Authentication): the active switching session is not securely bound to the operator identity that initiated it, so identity resolution during an active switch trusts the currently-impersonated (lower-privileged) account as though it were the originating operator. This confused-deputy authentication flaw lets the impersonated principal inherit the operator's switching capability. CPE data is thin - cpe:2.3:a:unknown:customer_switching:*:*:*:*:*:*:*:* lists an unknown vendor - so exact product lineage is not authoritatively pinned by NVD.

RemediationAI

Vendor-released patch: upgrade the Customer Switching plugin to version 2.1.3 or later, which is the fixed release per the vendor and WPScan advisory (https://wpscan.com/vulnerability/4e5b9e2a-c8e0-41db-a989-1b44bc76c9d8/). If immediate patching is not possible, restrict or disable use of the account-switching feature and limit which accounts operators may switch into, since exploitation requires an active operator-to-attacker switch session; audit user roles to remove unnecessary low-privileged accounts that could serve as attacker footholds, and monitor for unexpected privilege escalations. Disabling the switching feature removes the functionality operators rely on, so treat it as a temporary control until 2.1.3 is deployed. Confirm the running version against 2.1.3 after upgrade.