What is the CVSS score of CVE-2026-6456?

CVE-2026-6456 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Account Switcher are affected by CVE-2026-6456?

The BeycanPress Account Switcher WordPress plugin (versions through 1.0.2) enables unauthorized Administrator account seizure by any Subscriber-level user, exposing organizations to complete website…

How to fix or mitigate CVE-2026-6456?

Within 24 hours: Disable the BeycanPress Account Switcher plugin on all WordPress installations and audit recent administrator account activity for unauthorized transitions. Within 7 days: Review alternative account management solutions and confirm no unauthorized account access occurred during plugin deployment. Within 30 days: Permanently remove the plugin or replace with a patched version if the vendor releases one; document the decision in change management records.

Account Switcher CVE-2026-6456

EUVD-2026-31026 HIGH

Improper Authentication (CWE-287)

2026-05-20 Wordfence

GHSA-wrmc-3xq2-8pf7

WordPress PHP Authentication Bypass Privilege Escalation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:31 vuln.today

DescriptionCVE.org

The Account Switcher plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.2. This is due to the rememberLogin REST API endpoint using a loose comparison (!= instead of !==) for secret validation at app/RestAPI.php:111, combined with no validation that the secret is non-empty. When a target user has never used the "Remember me" feature, their asSecret user meta does not exist, causing get_user_meta() to return an empty string. An attacker can send an empty secret parameter, which passes the comparison ('' != '' is false), and the endpoint then calls wp_set_auth_cookie() for the target user. Additionally, all REST routes use permission_callback => '__return_true' with no capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to switch to any user account including Administrator, ultimately granting themselves full administrative privileges.

AnalysisAI

Privilege escalation in the BeycanPress Account Switcher WordPress plugin (versions up to and including 1.0.2) allows authenticated Subscriber-level users to hijack any account, including Administrator, by abusing a loose PHP comparison in the rememberLogin REST endpoint. No public exploit is identified at the time of analysis, but the issue is trivially reproducible from the disclosed root cause and the plugin source on WordPress.org is publicly indexable.

Technical ContextAI

The flaw lives in app/RestAPI.php:111 of the Account Switcher plugin, where secret validation uses PHP's loose inequality operator (!=) instead of strict (!==) when comparing the attacker-supplied 'secret' parameter to the target user's asSecret meta value. When the target user has never invoked the 'Remember me' feature, get_user_meta() returns an empty string, and PHP's type-juggling causes '' != '' to evaluate false, so the check passes; the endpoint then issues wp_set_auth_cookie() for the chosen user ID. Compounding the bug, every REST route in this plugin registers permission_callback => '__return_true' (see app/PluginHero/BaseAPI.php:54), so WordPress performs no capability check before reaching the vulnerable comparison. This is a textbook CWE-287 (Improper Authentication) instance caused by both weak type comparison and missing authorization, affecting the cpe:2.3:a:beycanpress:account_switcher product line.

RemediationAI

No vendor-released patch identified at time of analysis based on the provided references; administrators should monitor the WordPress.org plugin page (https://wordpress.org/plugins/account-switcher/) and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/9e9cfb9b-6951-4246-9cd6-dd64fee3a1bc?source=cve) for a release greater than 1.0.2. Until a fixed version is published, the safest compensating control is to deactivate and remove the Account Switcher plugin entirely, which eliminates the vulnerable REST routes at the cost of losing the account-switching feature. If the feature must remain, restrict access to /wp-json/account-switcher/* endpoints via a web application firewall rule or web server ACL limited to trusted administrator IP addresses, accepting the trade-off that legitimate switching from other networks will break; additionally, audit existing administrator and editor accounts and rotate credentials, since exploitation leaves no obvious artifact beyond a normal authenticated session cookie.