CVE-2026-6456

Vulnerability

Analysis

The Account Switcher plugin for WordPress, closed since May 14, 2026, contains a privilege escalation vulnerability in versions up to and including 1.0.2 [1]. The root cause lies in the rememberLogin REST API endpoint defined in app/RestAPI.php:111. The endpoint validates a user's secret using a loose comparison (!=), and also fails to check that the secret is non-empty. When a target user has never used the "Remember me" feature, their asSecret user meta does not exist; get_user_meta() returns an empty string. An attacker can send an empty secret parameter, causing the comparison '' != '' to evaluate as false, which passes validation. The endpoint then executes wp_set_auth_cookie() for the target user, logging the attacker in as that user.

Exploitation

An authenticated attacker with at least Subscriber-level privileges can exploit this flaw. The plugin's REST routes all use permission_callback => '__return_true' with no additional capability checks. This means the attacker can switch to any user account on the WordPress site, including those with Administrator roles. No nonce or special privilege is required beyond the attacker's own authenticated session.

Impact

By switching to an Administrator account, the attacker gains full administrative access to the WordPress installation. This includes the ability to modify site content, install plugins, change user roles, and potentially execute arbitrary code. The vulnerability is critical because it allows a low-privileged user to completely take over the site.

Mitigation

The plugin was closed on the WordPress.org plugin directory on May 14, 2026, and is pending a full review [1]. Users should immediately remove or replace the plugin with a trusted alternative. As of this writing, no patched version has been released. The vendor, BeycanPress LLC, has not yet provided an update on the plugin's repository.