Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: wp-buy Component: Login As User Or Customer (user Switching) Clear all filters
TI-2023-06631 CVE-2023-7247 · GHSA-grpx-32wr-q4c4

Login as User or Customer <= 3.8 - Admin Account Takeover

Priority MEDIUM 58

The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00636 Published 2024-03-11 No fix listed
TI-2022-03943 CVE-2022-4305 · GHSA-22mr-8pm7-gm4c

Login as User or Customer < 3.3 - Unauthenticated Privilege Escalation to Admin

Priority HIGH 75

The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.38625 Published 2023-01-23 Fixed in 3.3
TI-2021-06487 CVE-2021-24195 · GHSA-xx6m-fqm7-6ghv

Login as User or Customer (User Switching) < 1.9 - Arbitrary Plugin Installation/Activation via Low Privilege User

Priority MEDIUM 41

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin before 1.8, to install any plugin (including a specific version) f…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01325 Published 2021-05-14 Fixed in 1.8 CWE-285