CVE-2026-15240
Customer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrator via Insecure Operator Resolution
HIGH 7.5EPSS 0.3%
The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account, including an administrator, resulting in full account takeover.
- Affected
- Customer Switching
- CVSS v3.1 CNA
- 7.5 HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- 0.32% chance of exploitation in the next 30 days, 24th percentile
- Published
- 2026-07-30