CVE-2026-15240

Customer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrator via Insecure Operator Resolution

High · published July 30, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
24.0
In the wild
Unconfirmed
What it is

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account, including an administrator, resulting in full account takeover.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00323 · 24.0th percentile
Published
2026-07-30T06:00Z
EPSS history
Timeline
  • 30 JUL 06:00Z
    Customer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrator via Insecure Operator Resolution
    cvelistv5