{"id":"CVE-2026-93548","published":"2026-10-09T07:17:19.247","lastModified":"2026-10-09T15:17:20.140","description":"The FooSales  WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales  WordPress plugin before 1.43.3 act as an arbitrary other user, including an administrator, resulting in that user's account details being exposed and their account being taken over.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/7d9238eb-f56e-49db-a804-7505f59fca5c/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The FooSales WordPress plugin has a privilege escalation flaw that allows any authenticated user to impersonate any other user, including administrators, leading to potential account takeover and data exposure.","exploitability":"Easy to exploit with no special prerequisites - any authenticated user can make the plugin act as any other user by simply calling the affected API endpoint with a user ID parameter.","blast_radius":"High impact in environments where multiple users exist, especially if administrators are using the same plugin, as it could lead to full administrative control and exposure of sensitive user data.","remediation":"Upgrade to FooSales plugin version 1.43.3 or later to fix this privilege escalation vulnerability.","detection":"Monitor for unusual API calls to the FooSales plugin endpoints that contain user ID parameters, particularly those that appear to be acting on behalf of users other than the authenticated caller.","tags":["privilege-escalation","auth-bypass","wordpress"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:50:31.988Z"}}