CVE-2023-7247

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
Unknown	Login as User or Customer	<= 3.8
wp-buy	login_as_user_or_customer_\(user_switching\)	<= 3.8

References

https://drive.google.com/file/d/1GCOzJ-ZovYij9GIdmsrZrR9g8mlC22hs/view?usp=sharingExploit
https://wpscan.com/vulnerability/96b93253-31d0-4184-94b7-f1e18355d841/Exploit, Third Party Advisory
https://drive.google.com/file/d/1GCOzJ-ZovYij9GIdmsrZrR9g8mlC22hs/view?usp=sharingExploit
https://wpscan.com/vulnerability/96b93253-31d0-4184-94b7-f1e18355d841/Exploit, Third Party Advisory

Timeline

Published: Mar 11, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-72489.8Certain functionality in OpenText Vertica Management console might be prone to bypass via crafted requests. The vulnerability would affect CVE-2023-72499.8Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText OpenText Directory Services allows CVE-2023-72505.3A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send CVE-2023-72516.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows CVE-2023-72525.3The Tickera WordPress plugin before 3.5.2.5 does not prevent users from leaking other users' tickets.CVE-2023-72536.1The Import WP WordPress plugin before 2.13.1 does not prevent users with the administrator role from pinging conducting SSRF attacks, which CVE-2023-72564.4In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and po CVE-2023-72586.5A denial of service exists in Gvisor Sandbox where a bug in reference counting code in mount point tracking could lead to a panic, making it CVE-2023-72592.4** DISPUTED ** A vulnerability was found in zzdevelop lenosp up to 20230831. It has been classified as problematic. This affects an unknown CVE-2023-72607.5Path Traversal vulnerability discovered in OpenText™ CX-E Voice, affecting all version through 22.4. The vulnerability could allow arbitra CVE-2023-72617.8Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to perform privilege escalation CVE-2023-72637.3Some Huawei home music system products have a path traversal vulnerability. Successful exploitation of this vulnerability may cause unauthor