IT SBIT Services
Schneeberger
DEEN
CVE tracker

WPC Shop as a Customer for WooCommerce: Privilege escalation via account takeover

CVE-2026-95687High 8.8

← All vulnerabilities

Summary

The WordPress plugin WPC Shop as a Customer for WooCommerce, versions up to and including 2.0.0, does not check the target user's role before issuing a new login session. An authenticated attacker with a low-privilege account, such as a customer or subscriber, can send a WordPress Administrator's user ID to the wpcsa_login endpoint and receive a full Administrator session cookie without the Administrator's password. This gives the attacker full Administrator control over the website, including customer data, orders and payment settings.

Affected

  • WPC Shop as a Customer for WooCommerce (WordPress plugin) by WPClever, all versions up to and including 2.0.0
  • Default configuration: unaffected (per the CNA record)

Fixed in

  • Version 2.0.1 (WordPress.org changeset for tag 2.0.1). VulDB states that the role validation was addressed in 2.0.1 or later.
  • No WPClever vendor advisory found. Confirm the installed version is 2.0.1 or later.

Workaround

  • Deactivate the plugin until it is updated. This is a third-party recommendation; no vendor-documented mitigation was found.
  • After deactivation or update, rotate administrator passwords and invalidate active sessions, because Administrator sessions may already have been issued.
  • Review administrator accounts for unknown users and check logs for requests to the wpcsa_login endpoint.

Exploitation

  • Exploited in the wild: none known. Not listed in the CISA KEV catalog.
  • CISA SSVC assessment: exploitation none, not automatable, total technical impact.
  • Public exploit code: none confirmed (indicative only).
  • EPSS score: not yet computed.

Our recommendation

  • Inventory all WordPress sites running this plugin, including any with version 2.0.0 or lower.
  • Update to version 2.0.1 or later. If an update is not possible, deactivate the plugin.
  • Audit administrator accounts and active sessions, and reset passwords and sessions if anything looks unfamiliar.
  • Restrict customer self-registration if it is not needed, because the required low-privilege account is easy to obtain on many shops.
  • Monitor logs for requests to the wpcsa_login endpoint.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:01.

Original description (NVD)

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing an authenticated attacker to log in as any WordPress Administrator by directly supplying an Administrator's user ID to the wpcsa_login endpoint and receiving a full Administrator session cookie without supplying the Administrator's password. This makes it possible for authenticated attackers to perform a direct session takeover, gaining full Administrator-level access to the site.

NVD references (6)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed