Privilege Escalation in WPC Shop as a Customer for WooCommerce

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation in all versions up to and including 2.0.0. The vulnerability stems from a lack of proper role validation within the wpcsa_login endpoint. An attacker with a standard authenticated account can interact with this endpoint and supply a target administrator's user ID. The plugin subsequently fails to verify the requester's authority, granting the attacker a valid session cookie associated with the target administrator account. This bypasses the need for the administrator's password, effectively resulting in a full administrative account takeover. This flaw is critical for WordPress environments using WooCommerce, as it allows unauthorized users to modify site settings, install malicious plugins, or exfiltrate sensitive customer data.

Attack Chain

1. Attacker authenticates with a low-privileged account on a target WordPress site.
2. Attacker enumerates the target administrator user ID (e.g., via author archives or author rest API endpoints).
3. Attacker crafts an HTTP request targeting the vulnerable /wpcsa_login endpoint.
4. Attacker includes the target administrator's user ID as a parameter in the request.
5. The plugin server-side logic processes the request without validating if the current session has the capability to initiate a login as another user.
6. The server issues a valid session cookie for the administrator account to the attacker.
7. Attacker updates their browser session with the stolen administrator cookie to gain full site control.

Impact

Successful exploitation allows an authenticated attacker to gain full WordPress administrative control. This leads to complete site compromise, including the ability to execute arbitrary code via plugin installation, manipulate WooCommerce order data, and potentially access sensitive user information stored within the WordPress database.

Recommendation

• Update the WPC Shop as a Customer for WooCommerce plugin to the version containing the patch for CVE-2026-95687 immediately.
• If a patch is unavailable, deactivate or remove the WPC Shop as a Customer for WooCommerce plugin from production WordPress environments.
• Monitor access logs for repeated or unusual POST requests to the 'wpcsa_login' URI stem, particularly those associated with low-privileged user accounts.
• Audit WordPress user accounts to identify unauthorized administrative changes or newly created administrator accounts.