Privilege Escalation Vulnerability in WPC Shop as a Customer Plugin for WordPress

CVE-2026-95687

What is CVE-2026-95687?

The WPC Shop as a Customer for WooCommerce plugin contains a security flaw that enables authenticated attackers to escalate their privileges. This vulnerability stems from improper validation of user roles during the authentication process. By injecting a valid Administrator user ID into the wpcsa_login endpoint, an attacker can gain unauthorized access to the site as a full Administrator without needing the user's password. This raises serious security concerns as it allows potential attackers to perform administrative actions and compromise the entire WordPress environment.

References