Debugger Troubleshooter EUVD-2026-17245

Debugger & Troubleshooter WordPress plugin versions up to 1.3.2 must be installed and active. Attacker sets wp_debug_troubleshooter_simulate_user cookie to target user ID (e.g., admin ID=1) to gain impersonation. No authentication required; any remote visitor can exploit.

This vulnerability presents critical real-world risk despite the CVSS vector showing PR:L (low privileges required), which appears inconsistent with the unauthenticated nature described. The attack is trivially exploitable requiring only HTTP cookie manipulation (AV:N/AC:L) with no user interaction, allowing complete site takeover through administrator impersonation. The straightforward attack mechanism (setting a single cookie to any user ID) means automated scanning and exploitation are highly feasible. While no EPSS score or KEV status is provided in the intelligence, the technical simplicity and high impact (C:H/I:H/A:H - full confidentiality, integrity, and availability compromise) suggest this would be actively targeted if widely deployed. The primary mitigating factor is the limited install base of a debugging plugin, which may have lower deployment than mainstream WordPress plugins. However, any sites running vulnerable versions face immediate risk of complete compromise. The SSVC framework would classify this as high priority: exploitation is straightforward (automatable), technical impact is total (administrator access), and the scope includes any action an administrator can perform including persistent backdoor creation. Organizations should treat this as an emergency patch priority if the plugin is installed.

An unauthenticated attacker identifies a WordPress site running the vulnerable Debugger & Troubleshooter plugin through version fingerprinting or plugin enumeration. The attacker sends an HTTP request to any page on the site with a crafted cookie: wp_debug_troubleshoot_simulate_user=1 (where 1 is typically the administrator user ID). The plugin's filter hook immediately overrides WordPress authentication, granting the attacker full administrator privileges without any credentials. The attacker can then access wp-admin, create a new administrator account for persistent access, install a malicious plugin containing a web shell, modify site content to inject malware, or exfiltrate sensitive data including customer information and credentials. The attack requires no special tools beyond basic HTTP client capabilities and leaves the attacker with complete site control.