CVE-2026-93548
FooSales < 1.43.3 - Subscriber+ Privilege Escalation via User Impersonation
- State
- Published
- Severity
- 8.8 High
- Published
- Oct 9, 2026
- Updated
- Oct 9, 2026
- Reserved
- Sep 18, 2026
Description
The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales WordPress plugin before 1.43.3 act as an arbitrary other user, including an administrator, resulting in that user's account details being exposed and their account being taken over.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-269 Improper Privilege Management
Affected Products
| Product | Versions |
|---|---|
FooSalesUnknown |
|
References
- https://wpscan.com/vulnerability/7d9238eb-f56e-49db-a804-7505f59fca5c/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.