CVE-2026-95687 in WPC Shop as a Customer Plugin
Summary
by MITRE • 10/01/2026
The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing an authenticated attacker to log in as any WordPress Administrator by directly supplying an Administrator's user ID to the wpcsa_login endpoint and receiving a full Administrator session cookie without supplying the Administrator's password. This makes it possible for authenticated attackers to perform a direct session takeover, gaining full Administrator-level access to the site.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The WPC Shop as a Customer for WooCommerce plugin for WordPress contains a critical security flaw that allows for privilege escalation through account takeover in all versions up to and including 2.0.0. This vulnerability stems from an improper validation of user roles during the authentication process, specifically within the wpcsa_login endpoint. The core technical failure lies in the application's logic which fails to verify whether the target user possesses administrative privileges before issuing a new authentication session. Consequently, any authenticated attacker who can supply a valid Administrator user ID is able to bypass standard password verification mechanisms and obtain a full administrator-level session cookie without needing the actual credentials of that account.
From an operational perspective, this flaw enables direct session takeover by lower-privileged users or attackers with access to existing accounts on the WordPress installation. By exploiting this misconfiguration, malicious actors can escalate their privileges from limited user roles such as customer or subscriber directly to Administrator level. This grants them unrestricted control over the entire website environment, including the ability to modify site settings, install plugins and themes, access sensitive database information, and potentially deploy further malware or backdoors. The impact is severe because it effectively neutralizes the principle of least privilege that WordPress relies on for multi-user environments, allowing a single compromised low-privilege account to compromise the entire system integrity.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, as the application fails to enforce appropriate access controls when handling authentication requests. Furthermore, it maps directly to MITRE ATT&CK technique T1078, specifically Valid Accounts and Default Accounts subcategories related to account manipulation or takeover. The attack vector involves authenticated users interacting with a web service endpoint, which classifies this under network-based exploitation where the attacker leverages legitimate credentials to gain higher-level access than intended by the system design.
To mitigate this risk, administrators should immediately update the WPC Shop as a Customer for WooCommerce plugin to version 2.0.1 or later, where the developers have addressed the role validation logic in the wpcsa_login endpoint. Until an update is applied, it is advisable to restrict access to WordPress admin areas using IP whitelisting if possible and ensure that all user accounts utilize strong, unique passwords with multi-factor authentication enabled wherever supported by other plugins or core features. Additionally, implementing a Web Application Firewall can help detect and block suspicious patterns of session manipulation attempts targeting this specific endpoint. Regular security audits and monitoring for unusual administrative activity are also recommended to identify any potential exploitation in real-time.