Vulnerability · Published Jan 23, 2023 · Assigned by WPScan
CVE-2022-4305Login as User or Customer < 3.3 - Unauthenticated Privilege Escalation to Admin
Critical 9.8
In plain English
A critical-severity security flaw in Login as User or Customer from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 38.6% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)38.6%top 1.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Login as User or Customer | 0 – before 3.3 |
References
- https://wpscan.com/vulnerability/286d972d-7bda-455c-a226-fd9ce5f925bd exploit, vdb-entry, technical-description