FooSales WordPress plugin: Privilege escalation via user impersonation
Summary
The FooSales Point of Sale plugin for WooCommerce on WordPress does not verify that an authenticated caller is entitled to act as the user named in a request. Any logged-in user with a low-privilege role, such as a subscriber or customer, can act as another user, including an administrator. The attacker can then expose account details and take over the account, which can lead to full control of the WordPress site.
Affected
- FooSales WordPress plugin, all versions before 1.43.3
- Sources differ on the exact range: VulDB lists versions 1.43.0 to 1.43.2
Fixed in
- Version 1.43.3 (WPScan lists this as the fixed version)
Workaround
- No vendor workaround known.
- Until patched, restrict or disable open user registration.
- Review administrator and other privileged accounts for unexpected changes, and check for recent password or email changes.
Exploitation
- No evidence of exploitation in the wild found.
- CISA KEV: not listed. EPSS: 0.13%.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found; VulDB states no exploit is available.
Our recommendation
- Update the FooSales plugin to version 1.43.3 or later without delay.
- Check which plugin version is installed on every WordPress site with WooCommerce.
- Disable open self-registration if it is not needed.
- Review administrator accounts and recent account changes for signs of misuse.
- Monitor logs for unusual account changes or logins.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory wpscan.com
- WPScan plugin page: FooSales wpscan.com
- VulDB entry CVE-2026-93548 vuldb.com
- VulDB CVE page vuldb.com
- Vulners (Rapid7) CVE-2026-93548 vulners.com
- WordPress.org plugin page: FooSales wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:03.
Original description (NVD)
The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales WordPress plugin before 1.43.3 act as an arbitrary other user, including an administrator, resulting in that user's account details being exposed and their account being taken over.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.