CVE-2023-7247

The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.9 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
WPScanCNA
---
---
CVEADP
---
---
CISA-ADPADP
4.9 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 48%
VendorProductVersion
wp-buylogin_as_user_or_customer_\(user_switching\)
𝑥
≤ 3.8
wp-buylogin_as_user_or_customer_\(user_switching\)
𝑥
≤ 3.8
𝑥
= Vulnerable software versions
References
https://drive.google.com/file/d/1GCOzJ-ZovYij9GIdmsrZrR9g8mlC22hs/view?usp=sharing
https://wpscan.com/vulnerability/96b93253-31d0-4184-94b7-f1e18355d841/
https://drive.google.com/file/d/1GCOzJ-ZovYij9GIdmsrZrR9g8mlC22hs/view?usp=sharing
https://wpscan.com/vulnerability/96b93253-31d0-4184-94b7-f1e18355d841/