CVE-2026-6456
The Account Switcher plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.2.
Published May 20, 2026 · updated Jul 24, 2026
The Account Switcher plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.2. This is due to the REST API endpoint using a loose comparison ( instead of ) for secret validation at , combined with no validation that the secret is non-empty. When a target user has never used the "Remember me" feature, their user meta does not exist, causing to return an empty string. An attacker can send an empty parameter, which passes the comparison ( is ), and the endpoint then calls for the target user. Additionally, all REST routes use with no capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to switch to any user account including Administrator, ultimately granting themselves full administrative privileges.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
May 20, 2026 · NIST NVD
Detected
The Account Switcher plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.2. This is due to the REST API endpoint using a loose comparison ( instead of ) for secret validation at , combined with no validation that the secret is non-empty. When a target user has never used the "Remember me" feature, their user meta does not exist, causing to return an
Jul 24, 2026 · NIST NVD
Updated
The Account Switcher plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.2. This is due to the REST API endpoint using a loose comparison ( instead of ) for secret validation at , combined with no validation that the secret is non-empty. When a target user has never used the "Remember me" feature, their user meta does not exist, causing to return an
Sources
- CVE.orgVulnerability recordCVE-2026-6456
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-6456
The Account Switcher plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.2. This is due to the REST API endpoint using a loose comparison ( instead of ) for secret validation at , combi
nvd.nist.gov