CVE-2021-24195 describes a critical vulnerability in the Login as User or Customer (User Switching) WordPress plugin prior to version 1.8. This flaw allows low-privileged users to leverage an AJAX action to install any plugin from the WordPress repository, including specific versions, and activate arbitrary plugins already on the blog. This could enable attackers to install vulnerable plugins, potentially leading to more severe compromises like Remote Code Execution (RCE). The vulnerability carries a CVSS score of 8.8 (High), indicating a significant risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While the vulnerability requires low privileges, no user interaction is needed once those privileges are obtained. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting a low level of public awareness or immediate threat perception.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.8, < 1.8CPE match | cpe:2.3:a:wp-buy:login_as_user_or_customer_\(user_switching\):*:*:*:*:*:wordpress:*:* | ||
< 1.8CPE matchmatch criteria | cpe:2.3:a:wp-buy:login_as_user_or_customer_\(user_switching\):*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.