PT-2026-29142 · WordPress · Wordpress Debugger & Troubleshooter

Nabil Irawan · Published 2026-03-30 · Updated 2026-03-30 · CVE-2026-5130

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WordPress Debugger & Troubleshooter plugin versions through 1.3.2

Description The Debugger & Troubleshooter plugin for WordPress was susceptible to Unauthenticated Privilege Escalation. The plugin accepted the wp debug troubleshoot simulate user cookie value directly as a user ID without validation. This allowed unauthenticated attackers to impersonate any user, including administrators, by setting the cookie to a target user ID. This could lead to complete control of the WordPress site, including creating new administrator accounts and modifying site content. The issue was addressed by implementing a cryptographic token-based validation system, restricting user simulation to administrators and requiring a validated token.

Recommendations Update to version 1.4.0 or later to implement the cryptographic token-based validation system.

Fix

LPE

Weakness Enumeration

CWE-565

Related Identifiers

CVE-2026-5130

Affected Products

Wordpress Debugger & Troubleshooter

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-5130 · Security Note
• https://plugins.trac.wordpress.org/changeset/3486202/debugger-troubleshooter/trunk/debug-troubleshooter.php · Note
• https://twitter.com/CveFindCom/status/2038763917535531013 · Twitter Post
• https://plugins.trac.wordpress.org/browser/debugger-troubleshooter/tags/1.3.2/debug-troubleshooter.php#L827 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3e037931-870f-45eb-973c-0276911682ad?source=cve · Note
• https://twitter.com/TheHackerWire/status/2038758339283402755 · Twitter Post
• https://plugins.trac.wordpress.org/browser/debugger-troubleshooter/tags/1.3.2/debug-troubleshooter.php#L849 · Note