CVE-2026-6456
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
The Account Switcher plugin for WordPress versions up to and including 1.0.2 contains a privilege escalation vulnerability. This is due to the `rememberLogin` REST API endpoint using a loose comparison (`!=` instead of `!==`) for secret validation, combined with no validation that the secret is non-empty. When a target user has never used the "Remember me" feature, their `asSecret` user meta does not exist, causing `get_user_meta()` to return an empty string. An attacker can send an empty `secret` parameter, which passes the comparison (`'' != ''` is `false`), and the endpoint then calls `wp_set_auth_cookie()` for the target user. Additionally, all REST routes use `permission_callback => '__return_true'` with no capability checks. This makes it possible for authenticated attackers with Subscriber-level access and above to switch to any user account including Administrator, ultimately granting themselves full administrative privileges.
Risk Assessment
An authenticated attacker with low privileges can take over an administrator account and fully compromise the WordPress site.
Recommendation
Update the Account Switcher plugin to a version later than 1.0.2 that fixes this vulnerability.
Related vulnerabilities
- CVE-2026-19583Critical
Velociraptor allows some sensitive artifacts to be gated by additional permissions, e.g. Linux.Sys.BashShell requires EXECVE. However, no such check was implemented for client monitoring artifacts, and there was no requirement that they carry the CLIENT_EVENTS type. This allows any user who can schedule client monitoring artifacts to also schedule otherwise restricted artifacts.
- CVE-2026-18351Critical
The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in is_file_type_valid(), which uses the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, allowing blacklist bypass. This makes it possible for unauthenticated attackers to upload executable files and achieve remote code execution.
- CVE-2026-87931Critical
A vulnerability has been found in Behavioral Technology Group Pavlok Behavioral Conditioning Wearable up to 20260707. Impacted is an unknown function of the Apple Notification Center Service Event Handler component. The manipulation leads to buffer overflow, and the attack must be carried out from within the local network. The vendor was contacted but did not respond.
- CVE-2026-88069Critical
Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker able to submit a malicious file for analysis could use path traversal sequences or crafted paths to cause extracted content to be written outside the designated extraction directory, potentially overwriting files accessible to the Pandora worker process.
- CVE-2026-87911Critical
An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... TO PROGRAM statement into content that is processed when an authenticated user interacts with the MCP server in its default read-only mode.
- CVE-2026-54694Critical
SkillTree before version 4.4.2 contains an XSS vulnerability resulting from a combination of two flaws: lack of HTML encoding in StringHighlighter.js and use of v-html in HighlightedValue.vue. An attacker can register an account with malicious firstName/lastName/nickname fields, and when an administrator opens the Quiz Runs page, the payload executes in their browser. There are three attack paths with escalating impact: basic XSS, remote script loading via import(), and CSRF token theft.
- CVE-2026-87929Critical
MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious ci_session cookie with administrator privileges by computing an HMAC-SHA1 using the publicly known encryption key, bypassing authentication checks in is_login() and mso_check_allow() functions.
- CVE-2026-47156Critical
MantisBT versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mci_check_login() function. Any user knowing any valid cookie_string can authenticate as any other user (knowing their username), including the administrator, without knowing the target's password. The vulnerability is exploitable with zero prior access on default installations because self-registration is enabled by default.
- CVE-2026-68484Critical
Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify user privileges, allowing authenticated low-privileged users to create administrator accounts and obtain elevated privileges.
- CVE-2026-67403Critical
Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid non predictable tenant identifier.
Original NVD description (English source)
The Account Switcher plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.2. This is due to the `rememberLogin` REST API endpoint using a loose comparison (`!=` instead of `!==`) for secret validation at `app/RestAPI.php:111`, combined with no validation that the secret is non-empty. When a target user has never used the "Remember me" feature, their `asSecret` user meta does not exist, causing `get_user_meta()` to return an empty string. An attacker can send an empty `secret` parameter, which passes the comparison (`'' != ''` is `false`), and the endpoint then calls `wp_set_auth_cookie()` for the target user. Additionally, all REST routes use `permission_callback => '__return_true'` with no capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to switch to any user account including Administrator, ultimately granting themselves full administrative privileges.