CVE-2023-7247 Login as User or Customer <= 3.8 - Admin Account Takeover
The Login as User or Customer WordPress plugin allows attackers to log in as any other user, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-7247?
CVE-2023-7247 is a medium-severity authentication bypass vulnerability in Unknown Login as User or Customer, published on 11 Mar 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.
Which versions are affected by CVE-2023-7247?
It affects 1 product.
Products include Wp-Buy Login as User or Customer \(User Switching\).
How do I fix CVE-2023-7247?
No fix has been published for CVE-2023-7247 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-7247 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-7247 exists.
Other vulnerabilities in Unknown Login as User or Customer
Sources
Also known as CVE-2023-5947, GHSA-grpx-32wr-q4c4.