What’s Vulnerable › Vulnerabilities
CVE-2026-15240: Customer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrator via Insecure Operator Resolution
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-30 · updated 2026-07-30
- Weakness: CWE-287
Description
The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account, including an administrator, resulting in full account takeover.
Affected products
- Customer Switching: before 2.1.3 — fixed in 2.1.3
How to fix
Upgrade to a fixed version: Customer Switching 2.1.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-15240 or the next vulnerability affects your stack