EUVD-2026-31026
GHSA-wrmc-3xq2-8pf7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or log in as Subscriber
-
DeliveryEnumerate administrator user IDs
-
ExploitSend REST request to rememberLogin with empty secret
-
ExecutionLoose comparison passes and auth cookie issued for admin
-
PersistUse admin session to upload malicious plugin
-
ImpactAchieve full site and server compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) the BeycanPress Account Switcher plugin (version ≤1.0.2) installed and active on the target WordPress site, (2) an authenticated session at Subscriber level or higher - consistent with the CVSS PR:L vector - which is trivially obtainable on any site permitting open user registration, (3) network reachability to /wp-json/ REST endpoints (default WordPress configuration), and (4) a target user account whose asSecret user meta is absent or empty, which is the default state for any user who has never invoked the plugin's 'Remember me' flow. No user interaction by the victim is required (UI:N) and no non-default configuration is needed beyond the plugin's presence; the principal limiting factor is that targets who have previously used Remember me will have a populated asSecret value and are not exploitable via the empty-secret path. |
| Impact | Signals are largely consistent and point to a real, high-priority risk for any site running this plugin. CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H) reflects network-reachable exploitation with low attack complexity, only Subscriber-level privileges (PR:L), and full compromise of confidentiality, integrity, and availability since takeover of an Administrator account yields complete WordPress control. EPSS and SSVC values were not supplied in the input, and the CVE is not listed in CISA KEV, so quantitative exploitation probability and automation potential cannot be cited; however, the exploit requires only a single REST call with an empty 'secret' field, making it highly automatable in practice. No POC is referenced in the provided sources, but the Wordfence advisory plus the linked plugins.trac source lines effectively constitute a roadmap, so weaponization is likely once the advisory propagates. |
| Exploit ScenarioDerived | An attacker registers (or compromises) any low-privilege WordPress account such as a Subscriber on a target site running Account Switcher 1.0.2 or earlier, then sends a single authenticated REST request to the rememberLogin endpoint specifying the Administrator's user ID and an empty 'secret' parameter. Because the target admin has never used 'Remember me', the loose comparison succeeds and the response sets an authentication cookie for the Administrator, after which the attacker can install malicious plugins, plant a backdoor, or pivot to the underlying host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 20, 2026
Privilege escalation in the BeycanPress Account Switcher WordPress plugin (versions up to and including 1.0.2) allows authenticated Subscriber-level users to hijack any account, including Administrator, by abusing a loose PHP comparison in the rememberLogin REST endpoint. No public exploit is identified at the time of analysis, but the issue is trivially reproducible from the disclosed root cause and the plugin source on WordPress.org is publicly indexable.
RemediationAI
No vendor-released patch identified at time of analysis based on the provided references; administrators should monitor the WordPress.org plugin page (https://wordpress.org/plugins/account-switcher/) and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/9e9cfb9b-6951-4246-9cd6-dd64fee3a1bc?source=cve) for a release greater than 1.0.2. Until a fixed version is published, the safest compensating control is to deactivate and remove the Account Switcher plugin entirely, which eliminates the vulnerable REST routes at the cost of losing the account-switching feature. If the feature must remain, restrict access to /wp-json/account-switcher/* endpoints via a web application firewall rule or web server ACL limited to trusted administrator IP addresses, accepting the trade-off that legitimate switching from other networks will break; additionally, audit existing administrator and editor accounts and rotate credentials, since exploitation leaves no obvious artifact beyond a normal authenticated session cookie.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in app/RestAPI.php:111 of the Account Switcher plugin, where secret validation uses PHP's loose inequality operator (!=) instead of strict (!==) when comparing the attacker-supplied 'secret' parameter to the target user's asSecret meta value. When the target user has never invoked the 'Remember me' feature, get_user_meta() returns an empty string, and PHP's type-juggling causes '' != '' to evaluate false, so the check passes; the endpoint then issues wp_set_auth_cookie() for the chosen user ID. Compounding the bug, every REST route in this plugin registers permission_callback => '__return_true' (see app/PluginHero/BaseAPI.php:54), so WordPress performs no capability check before reaching the vulnerable comparison. This is a textbook CWE-287 (Improper Authentication) instance caused by both weak type comparison and missing authorization, affecting the cpe:2.3:a:beycanpress:account_switcher product line.
Know when Account Switcher gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Account Switcher plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.2. This is due to the rememberLogin REST API endpoint using a loose comparison (!= instead of !==) for secret validation at app/RestAPI.php:111, combined with no validation that the secret is non-empty. When a target user has never used the "Remember me" feature, their asSecret user meta does not exist, causing get_user_meta() to return an empty string. An attacker can send an empty secret parameter, which passes the comparison ('' != '' is false), and the endpoint then calls wp_set_auth_cookie() for the target user. Additionally, all REST routes use permission_callback => '__return_true' with no capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to switch to any user account including Administrator, ultimately granting themselves full administrative privileges.
Executive ViewAI
The BeycanPress Account Switcher WordPress plugin (versions through 1.0.2) enables unauthorized Administrator account seizure by any Subscriber-level user, exposing organizations to complete website control, data theft, and operational sabotage. This vulnerability poses an immediate risk to all WordPress installations running this plugin, potentially affecting critical business infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately disable the plugin via WordPress admin panel, (2) Restrict REST API endpoint access (wp-json/*/v1/rememberLogin) to authenticated Admin-level users only using Web Application Firewall rules, (3) Implement IP whitelisting for wp-json endpoints at the network perimeter, (4) Enable comprehensive audit logging for admin account activity and review for unauthorized login events, (5) Enforce multi-factor authentication on all administrative accounts with privileged access levels.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB