CVE-2023-7247

MEDIUM

Published Mar 11, 2024 Modified May 1, 2025

Description

The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.

Is your site exposed to CVE-2023-7247?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.9

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected Products

Vendor	Product	Versions
wp-buy	login_as_user_or_customer_\(user_switching\)	< 3.8

References

Exploits

https://drive.google.com/file/d/1GCOzJ-ZovYij9GIdmsrZrR9g8mlC22hs/view?usp=sharing https://wpscan.com/vulnerability/96b93253-31d0-4184-94b7-f1e18355d841/ https://drive.google.com/file/d/1GCOzJ-ZovYij9GIdmsrZrR9g8mlC22hs/view?usp=sharing https://wpscan.com/vulnerability/96b93253-31d0-4184-94b7-f1e18355d841/

Frequently Asked Questions

What is CVE-2023-7247? +

The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site. It has a CVSS v3.1 base score of 4.9 (MEDIUM).

How severe is CVE-2023-7247? +

CVE-2023-7247 has a CVSS v3.1 score of 4.9 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2023-7247? +

CVE-2023-7247 affects products from wp-buy, specifically: login_as_user_or_customer_\(user_switching\). Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2023-7247? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-6690 6.1

The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to external …

CVE-2024-49306 5.3

Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Content Copy Protection & No Right Click wp-content-copy-protector allows Cross Site Request …

CVE-2024-6693 4.8

The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege …

CVE-2024-13627 4.7

The OWL Carousel Slider WordPress plugin through 2.2 does not sanitise and escape a parameter before outputting it back in …