CVE-2026-93548

Summary

The FooSales WordPress plugin has a privilege escalation flaw that allows any authenticated user to impersonate any other user, including administrators, leading to potential account takeover and data exposure.

Exploitability

Easy to exploit with no special prerequisites - any authenticated user can make the plugin act as any other user by simply calling the affected API endpoint with a user ID parameter.

Blast radius

High impact in environments where multiple users exist, especially if administrators are using the same plugin, as it could lead to full administrative control and exposure of sensitive user data.

Detection

Monitor for unusual API calls to the FooSales plugin endpoints that contain user ID parameters, particularly those that appear to be acting on behalf of users other than the authenticated caller.

Prioritized remediation

Upgrade to FooSales plugin version 1.43.3 or later to fix this privilege escalation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.