Customer Switching
Monthly
Full account takeover in the Customer Switching WordPress plugin before 2.1.3 allows a low-privileged user, while an operator is actively switched into their account, to be resolved as that operator and switch into any permitted account including an administrator. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.14% (4th percentile) and it is not in CISA KEV; no public exploit identified as actively used at time of analysis.
Full account takeover in the Customer Switching WordPress plugin before 2.1.3 allows a low-privileged user, while an operator is actively switched into their account, to be resolved as that operator and switch into any permitted account including an administrator. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.14% (4th percentile) and it is not in CISA KEV; no public exploit identified as actively used at time of analysis.