FooSales WordPress Plugin CVE-2026-93548

Exploitation requires the attacker to hold a valid authenticated account on the target WordPress site (PR:L) - any role suffices, including a self-registered customer account if registration is open. The site must run FooSales prior to version 1.43.3. No user interaction by the victim is needed (UI:N), and the attack is fully remote over the network (AV:N) against the plugin's normal request handling. The limiting factor is the authentication requirement: sites that do not allow untrusted users to register or hold accounts substantially reduce exposure, and sites already updated to 1.43.3 are not affected.

This is a broken-access-control / privilege-escalation flaw (CWE-269) where the plugin fails to verify that an authenticated caller is entitled to act as the user named in a request, enabling any authenticated user to impersonate and take over an arbitrary account including an administrator. The input CVSS vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H = 8.8) is internally consistent with the description: network-reachable, low complexity, and requiring only low-privilege authentication (PR:L) rather than no authentication - any existing account suffices. Exploitation signals are mixed: publicly available exploit code exists (reported by WPScan) and a patch is available, yet the EPSS score is very low (0.13%, 2nd percentile) and the CVE is NOT on CISA KEV, indicating no confirmed real-world mass exploitation despite the public POC. The low EPSS likely reflects the product's modest footprint and the authentication prerequisite rather than low technical severity - the impact (full admin account takeover) is genuinely high. Net: a real and credible priority for any site actually running vulnerable FooSales with untrusted authenticated users (e.g., customer or staff accounts), but not an indiscriminate internet-wide emergency. Patch to 1.43.3 is the clear mitigation.

An attacker registers or already holds a low-privilege account (e.g., customer or staff) on a WordPress site running vulnerable FooSales, then issues a plugin request naming an administrator's user as the target. Because the plugin never checks that the caller is entitled to act as the named user, the request is honored, exposing the admin's account details and allowing the attacker to take over the administrator account. Public exploit code exists (WPScan), lowering the effort required.