What’s Vulnerable › Vulnerabilities

CVE-2022-4305: Login as User or Customer < 3.3 - Unauthenticated Privilege Escalation to Admin

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 38.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-01-23 · updated 2026-06-17

Description

The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.

Affected products

• Login as User or Customer: before 3.3 — fixed in 3.3

How to fix

Upgrade to a fixed version: Login as User or Customer 3.3. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/286d972d-7bda-455c-a226-fd9ce5f925bd
• https://wpscan.com/vulnerability/286d972d-7bda-455c-a226-fd9ce5f925bd

Get alerted when CVE-2022-4305 or the next vulnerability affects your stack