CVE-2023-7247
Login as User or Customer <= 3.8 - Admin Account Takeover
The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Login as User or Customer <= 3.8 - Admin Account Takeover
The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.
- Record
CVE-2023-7247- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
EUVDEUVD-2023-59428
The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.
- Record
EUVD-2023-59428- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-grpx-32wr-q4c4
The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as...
The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.
- Record
GHSA-grpx-32wr-q4c4- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
NVD
The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.
- Record
CVE-2023-7247- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-7247 is a medium vulnerability (CVSS 4.9) in Unknown Login As User Or Customer, published March 11, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 50th percentile. No source names a fixed version.