CVE-2026-15240
High
Description
The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account, including an administrator, resulting in full account takeover.
SeverityHigh
CVSS7.5
Exploit probability—
ProductCustomer Switching
PublishedJul 30, 2026
First seenJul 30, 2026
Weakness typeCWE-287Improper authentication
How to fix
Update
- Customer Switching2.1.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Customer Switching | v < 2.1.3 | 2.1.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.