What is the CVSS score of CVE-2026-5617?

CVE-2026-5617 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-5617?

The Login as User WordPress plugin versions 1.0.3 and earlier contain a critical privilege escalation vulnerability that allows any subscriber-level user to gain full administrator access through…

How to fix or mitigate CVE-2026-5617?

Within 24 hours: Audit all WordPress installations for Login as User plugin presence and document affected versions. Within 7 days: Disable or remove the Login as User plugin on all sites running version 1.0.3 or earlier; if functionality is required, evaluate alternative plugins with current security reviews. Within 30 days: Establish a plugin management policy requiring security assessment before deployment and automated vulnerability scanning for all installed plugins.

WordPress CVE-2026-5617

EUVD-2026-22844 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-15 Wordfence

Authentication Bypass Privilege Escalation WordPress

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 20:37 vuln.today

cvss_changed

Analysis Generated

Apr 15, 2026 - 08:36 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 08:30 euvd

EUVD-2026-22844

Analysis Generated

Apr 15, 2026 - 08:30 vuln.today

CVE Published

Apr 15, 2026 - 07:45 nvd

HIGH 8.8

DescriptionCVE.org

The Login as User plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the handle_return_to_admin() function trusting a client-controlled cookie (oclaup_original_admin) to determine which user to authenticate as, without any server-side verification that the cookie value was legitimately set during an admin-initiated user switch. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to administrator by setting the oclaup_original_admin cookie to an administrator's user ID and triggering the "Return to Admin" functionality.

AnalysisAI

Privilege escalation in Login as User WordPress plugin (all versions ≤1.0.3) allows authenticated subscribers to become administrators by manipulating a client-side cookie. Attackers with Subscriber-level access can set the 'oclaup_original_admin' cookie to an admin user ID and trigger the 'Return to Admin' function, granting full admin privileges. CVSS 8.8 (High) with network vector, low complexity, and low privileges required. No public exploit identified at time of analysis, EPSS data not available. Wordfence reported vulnerability with direct source code references to vulnerable functions in class-login-handler.php.

Technical ContextAI

The vulnerability exists in the handle_return_to_admin() function within the Login as User WordPress plugin (CPE: cpe:2.3:a:royalnavneet:login_as_user_-_switch_user_&_woocommerce_login_as_customer). The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), where the plugin implicitly trusts the client-controlled cookie 'oclaup_original_admin' to determine user authentication context during admin-to-user switching operations. The vulnerable code fails to implement server-side verification that the cookie value was legitimately set during an authorized admin-initiated user switch session. The plugin's intended functionality allows administrators to impersonate other users for testing or support purposes, with a 'Return to Admin' feature to restore the original admin session. However, the implementation stores the original admin user ID in a client-side cookie without cryptographic protection, session binding, or validation that the current user actually originated from an admin session. An attacker can forge this cookie with any admin user ID, and the plugin will authenticate them as that administrator when the return function is invoked.

RemediationAI

Immediately update the Login as User plugin to a patched version newer than 1.0.3 if available through the WordPress plugin repository at https://wordpress.org/plugins/one-click-login-as-user/. Check the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/c0c74d48-6cfc-4899-bd2c-4a80b1f6e05f?source=cve for the latest remediation guidance and confirmed fix version. If no patched version is available, immediately deactivate and remove the plugin until a secure update is released. As a temporary workaround, restrict user registration to prevent unauthorized subscriber account creation, and audit existing subscriber accounts for suspicious activity. Review WordPress user audit logs for unexpected privilege escalations or admin account access from lower-privileged users. Consider alternative user-switching plugins with established security track records and active maintenance. Implement web application firewall (WAF) rules to monitor for suspicious cookie manipulation attempts targeting the 'oclaup_original_admin' cookie parameter until the plugin can be patched or replaced.