Foosales
Monthly
Account takeover in the FooSales WordPress plugin before 1.43.3 allows any authenticated user to have the plugin act as an arbitrary other account, including an administrator, exposing that user's account details and enabling full account takeover. The vulnerability is a broken-access-control flaw (CWE-269) in which the plugin never verifies that the caller is entitled to act as the user named in a request; it is remote (AV:N), low-privilege (PR:L), and requires no victim interaction (UI:N), yielding a CVSS score of 8.8. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation and EPSS estimates only a 0.13% (2nd percentile) probability of exploitation. Any site running FooSales prior to 1.43.3 that permits untrusted users to hold accounts - for example, sites with open self-registration - is at meaningful risk.
Account takeover in the FooSales WordPress plugin before 1.43.3 allows any authenticated user to have the plugin act as an arbitrary other account, including an administrator, exposing that user's account details and enabling full account takeover. The vulnerability is a broken-access-control flaw (CWE-269) in which the plugin never verifies that the caller is entitled to act as the user named in a request; it is remote (AV:N), low-privilege (PR:L), and requires no victim interaction (UI:N), yielding a CVSS score of 8.8. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation and EPSS estimates only a 0.13% (2nd percentile) probability of exploitation. Any site running FooSales prior to 1.43.3 that permits untrusted users to hold accounts - for example, sites with open self-registration - is at meaningful risk.