Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2023-51484

WordPress Login as User or Customer plugin <= 3.8 - Unauthenticated Account Takeover vulnerability

Improper Authentication vulnerability in wp-buy Login as User or Customer (User Switching) allows Privilege Escalation.This issue affects Login as User or Customer (User Switching): from n/a through 3.8.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wp-buy
Products
Login As User Or Customer \(user Switching\)
CVE-2022-4305

Login as User or Customer < 3.3 - Unauthenticated Privilege Escalation to Admin

The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.

CVSS 3.1 · 9.8 Critical EPSS 38.6% KEV · Not listed
Vendors
Wp-buy
Products
Login As User Or Customer \(user Switching\)
CVE-2021-24195

Login as User or Customer (User Switching) < 1.9 - Arbitrary Plugin Installation/Activation via Low Privilege User

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin before 1.8, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Wp-buy
Products
Login As User Or Customer \(user Switching\)