The Login as User plugin for WordPress contains a critical privilege escalation vulnerability that allows authenticated attackers to gain administrative access.

The vulnerability exists in the handle_return_to_admin function, which trusts a user-controlled cookie (oclaup_original_admin) without verifying its legitimacy. This allows an authenticated user, with Subscriber-level privileges or higher, to escalate their account to administrator by manipulating the cookie and triggering the return functionality.

Successful exploitation of this vulnerability results in a complete compromise of the WordPress site. An attacker who gains administrative access can install malicious plugins, exfiltrate sensitive data, modify core site configurations, or delete the entire site, leading to significant reputational damage and potential loss of business continuity. The CVSS score of 8.8 reflects the high risk posed by this unauthorized privilege elevation.

Immediate Action: Update the Login as User plugin to the latest available version provided by the vendor to ensure the vulnerable function is properly secured.

Proactive Monitoring: Monitor WordPress user logs for suspicious account activity, particularly accounts that unexpectedly gain administrative privileges or perform actions outside their normal scope.

Compensating Controls: If an update is not immediately feasible, disable the plugin entirely to prevent exploitation until the patch can be applied.

Public Exploit Available: No

This vulnerability represents a high-severity threat to any WordPress installation utilizing the affected plugin. Administrators should prioritize updating the plugin immediately to the latest version to eliminate the possibility of unauthorized privilege escalation. Failure to patch allows even low-privileged users to assume full control over the site environment.