Login As User Switch User Woocommerce Login As Customer CVE-2026-5617

Requires WordPress with Login as User plugin versions up to 1.0.3 installed and activated. Attacker must be authenticated as Subscriber or above. No user interaction needed. Attacker crafts malicious oclaup_original_admin cookie to escalate to administrator without server-side verification.

This vulnerability presents elevated real-world risk despite requiring authenticated access. The CVSS 8.8 (High) score reflects network-based attack vector (AV:N), low attack complexity (AC:L), low privileges required (PR:L - subscriber level), no user interaction (UI:N), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The unchanged scope (S:U) indicates the vulnerability affects only the WordPress application, but complete admin takeover enables full site compromise. The low barrier to exploitation is concerning: WordPress subscriber accounts are often freely obtainable through self-registration on many sites, and the attack requires only basic HTTP cookie manipulation-no special tools or deep technical knowledge. EPSS data is unavailable, but the simplicity of exploitation (cookie manipulation) combined with the widespread use of WordPress and user-switching plugins suggests moderate exploitation probability if the plugin has significant installations. No CISA KEV listing or public exploit identified, indicating this is not yet widely exploited, but the straightforward attack path (evident from Wordfence's detailed source code references to lines 45 and 50 in class-login-handler.php) makes weaponization trivial for moderately skilled attackers. The SSVC framework would classify this as having confirmed exploitation potential (proof-of-concept level understanding from researcher disclosure), likely automatable (cookie manipulation is easily scripted), and total technical impact (full admin control). Priority depends on whether the plugin is installed; if present, immediate remediation is critical.

An attacker registers a free subscriber account on a WordPress site running the vulnerable Login as User plugin. Using browser developer tools or a proxy like Burp Suite, they set a cookie named 'oclaup_original_admin' with the value '1' (the typical admin user ID in WordPress). The attacker then navigates to or crafts a request that triggers the plugin's 'Return to Admin' functionality, which calls handle_return_to_admin(). The plugin reads the forged cookie value without verification and authenticates the attacker as user ID 1-the site administrator. The attacker now has full administrative control, enabling them to install malicious plugins, modify site content, create backdoor accounts, steal sensitive data, or completely deface the website.