EUVD-2026-17245
GHSA-24w3-v7fc-cjwv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Debugger & Troubleshooter plugin for WordPress was vulnerable to Unauthenticated Privilege Escalation in versions up to and including 1.3.2. This was due to the plugin accepting the wp_debug_troubleshoot_simulate_user cookie value directly as a user ID without any cryptographic validation or authorization checks. The cookie value was used to override the determine_current_user filter, which allowed unauthenticated attackers to impersonate any user by simply setting the cookie to their target user ID. This made it possible for unauthenticated attackers to gain administrator-level access and perform any privileged actions including creating new administrator accounts, modifying site content, installing plugins, or taking complete control of the WordPress site. The vulnerability was fixed in version 1.4.0 by implementing a cryptographic token-based validation system where only administrators can initiate user simulation, and the cookie contains a random 64-character token that must be validated against database-stored mappings rather than accepting arbitrary user IDs.
AnalysisAI
Unauthenticated privilege escalation in Debugger & Troubleshooter WordPress plugin (versions ≤1.3.2) allows remote attackers to gain administrator access by manipulating a cookie value. Attackers can set the wp_debug_troubleshoot_simulate_user cookie to any user ID without cryptographic validation, bypassing all authentication and authorization checks to immediately impersonate administrators. No public exploit code confirmed at time of analysis, though the attack mechanism is straightforward requiring only cookie manipulation. CVSS 8.8 with network-based attack vector and low complexity indicates significant real-world risk for unpatched installations. Vendor-released patch in version 1.4.0 implements cryptographic token validation.
Technical ContextAI
This vulnerability stems from insecure direct object reference (CWE-565) in the plugin's user simulation feature. The plugin hooks into WordPress's determine_current_user filter and accepts the wp_debug_troubleshoot_simulate_user cookie value directly as a user ID without any validation. The vulnerable code path (lines 827-849 in version 1.3.2) reads the cookie and immediately uses its numeric value to override the current user context. WordPress's determine_current_user filter is a critical authentication mechanism that runs early in the request lifecycle to establish user identity. By accepting arbitrary cookie values without cryptographic signing, HMAC validation, or capability checks, the plugin creates a direct authentication bypass. The affected product (CPE: cpe:2.3:a:jhimross:debugger_&_troubleshooter) is a debugging tool intended for development environments but often inadvertently left active on production sites. The fix in version 1.4.0 implements a proper token-based system where administrators generate 64-character random tokens stored in the database, ensuring only legitimate simulation sessions initiated by privileged users can override authentication.
RemediationAI
Immediately upgrade to Debugger & Troubleshooter version 1.4.0 or later, which implements cryptographic token-based validation for user simulation functionality. The patch is available through the WordPress plugin repository, with the security fix documented in changeset 3486202 viewable at https://plugins.trac.wordpress.org/changeset/3486202/debugger-troubleshooter/trunk/debug-troubleshooter.php. If immediate patching is not possible, disable and remove the plugin entirely until upgrade can be completed, as this is a debugging tool typically not required in production environments. After upgrading, review administrator user accounts and recent administrative actions for unauthorized changes, as attackers exploiting this vulnerability could have created persistent backdoor accounts. Check WordPress user lists for unfamiliar administrator accounts, review recently installed plugins and themes, and examine recent content modifications. Organizations should audit whether this debugging plugin is necessary in production and consider restricting such tools to development environments only.
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today