{"id":"CVE-2026-15240","aliases":["EUVD-2026-50996","GHSA-fpgp-7gxr-qx3q"],"status":"published","title":"Customer Switching for WooCommerce \u003c 2.1.3 - Customer+ Privilege Escalation to Administrator via Insecure Operator Resolution","description":"The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account, including an administrator, resulting in full account takeover.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00323,"percentile":0.25521,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-07-30T06:00:08Z","modified":"2026-07-30T15:32:51Z","products":[{"vendor":"unknown","product":"customer switching"}],"references":[{"url":"https://wpscan.com/vulnerability/4e5b9e2a-c8e0-41db-a989-1b44bc76c9d8/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15240"},{"url":"https://wpscan.com/vulnerability/4e5b9e2a-c8e0-41db-a989-1b44bc76c9d8"},{"url":"https://github.com/advisories/GHSA-fpgp-7gxr-qx3q"}],"sources":{"cve":[{"id":"CVE-2026-15240","title":"Customer Switching for WooCommerce \u003c 2.1.3 - Customer+ Privilege Escalation to Administrator via Insecure Operator Resolution","description":"The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account, including an administrator, resulting in full account takeover.","status":"published","published":"2026-07-30T06:00:08.638Z","modified":"2026-07-30T14:35:58.587Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T13:47:39.876248Z"}],"euvd":[{"id":"EUVD-2026-50996","description":"The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account, including an administrator, resulting in full account takeover.","status":"published","published":"2026-07-30T06:00:08Z","modified":"2026-07-30T14:35:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:28.93005Z"}],"ghsa":[{"id":"GHSA-fpgp-7gxr-qx3q","title":"The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user...","description":"The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account, including an administrator, resulting in full account takeover.","status":"published","published":"2026-07-30T06:32:36Z","modified":"2026-07-30T15:32:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:09:57.28787Z"}],"nvd":[{"id":"CVE-2026-15240","description":"The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account, including an administrator, resulting in full account takeover.","status":"published","published":"2026-07-30T06:25:01.6Z","modified":"2026-07-30T15:16:26.25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:33.955581Z"}]}}