Authentication Bypass in WP User Switch Plugin for WordPress

CVE-2023-2546

Summary

The WP User Switch plugin for WordPress has a vulnerability allowing authenticated attackers, even with the lowest subscriber-level permissions, to bypass authentication checks due to improper handling of the 'wpus_who_switch' cookie value in the 'wpus_allow_user_to_admin_bar_menu' function. This security flaw can result in unauthorized users gaining access to the accounts of other users, including administrators, provided they know the usernames. This issue affects all versions of the WP User Switch plugin up to and including 1.0.2 and highlights the importance of proper authorization measures in web applications.

References