PT-2026-33011 · WordPress · Login As User

Published 2026-04-15 · Updated 2026-04-24 · CVE-2026-5617

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Login as User plugin for WordPress versions prior to 1.0.4

Description An issue exists where the handle return to admin() function trusts a client-controlled cookie oclaup original admin to determine the user for authentication. Because there is no server-side verification to ensure the cookie was legitimately set during an admin-initiated user switch, authenticated attackers with Subscriber-level access or higher can escalate their privileges to administrator. This is achieved by setting the oclaup original admin cookie to an administrator's user ID and triggering the Return to Admin functionality.

Recommendations Update to a version later than 1.0.3.

Fix

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-5617

Affected Products

Login As User

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-5617 · Security Note
• https://plugins.trac.wordpress.org/browser/one-click-login-as-user/tags/1.0.3/includes/class-login-handler.php#L50 · Note
• https://twitter.com/CVEnew/status/2044338837674144161 · Twitter Post
• https://plugins.trac.wordpress.org/browser/one-click-login-as-user/trunk/includes/class-login-handler.php#L45 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c0c74d48-6cfc-4899-bd2c-4a80b1f6e05f?source=cve · Note
• https://reddit.com/r/StopBadBots/comments/1su8tkw/unpatched_threat_why_you_must_remove_these_29 · Reddit Post
• https://plugins.trac.wordpress.org/browser/one-click-login-as-user/tags/1.0.3/includes/class-login-handler.php#L45 · Note
• https://wordpress.org/plugins/one-click-login-as-user · Note