CVE-2024-9522: WP Users Masquerade Auth Bypass Flaw

CVE-2024-9522 Overview

CVE-2024-9522 is an authentication bypass vulnerability in the WP Users Masquerade plugin for WordPress. The flaw exists in all versions up to and including 2.0.0 and stems from incorrect authentication and capability checks in the ajax_masq_login function. Authenticated attackers with subscriber-level access or higher can exploit this weakness to log in as any user on the site, including administrators. The issue is tracked under CWE-288 (Authentication Bypass Using an Alternate Path) and CWE-306 (Missing Authentication for Critical Function).

Critical Impact
A low-privileged subscriber account can be used to assume administrator identity, resulting in full site takeover.

Affected Products

WP Users Masquerade plugin for WordPress (vendor lagunaisw)
All versions up to and including 2.0.0
WordPress sites where the plugin is installed and active

Discovery Timeline

2024-10-10 - CVE-2024-9522 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9522

Vulnerability Analysis

The WP Users Masquerade plugin allows administrators to log in as another user for troubleshooting and support tasks. The masquerade action is exposed via a WordPress AJAX endpoint that invokes the ajax_masq_login function. That function fails to correctly verify whether the caller holds the capability required to switch identities. As a result, any authenticated user, including subscribers, can invoke the endpoint and specify an arbitrary target user ID.

Once the endpoint accepts the request, the plugin issues an authenticated session cookie for the target account. An attacker who supplies the ID of an administrator receives a valid administrator session without providing credentials or a second factor.

Root Cause

The root cause is missing authorization enforcement in the AJAX handler. The plugin registers the ajax_masq_login action but does not gate execution behind a current_user_can() check for an administrator-level capability such as manage_options or edit_users. The handler also does not adequately validate the nonce context against the acting user's privileges. This combination allows a low-privileged authenticated user to reach code paths intended only for administrators.

Attack Vector

Exploitation requires network access to the WordPress site and any authenticated account, which can be obtained through standard user registration on sites that allow it. The attacker sends a crafted POST request to admin-ajax.php invoking the masquerade action with the target user ID. No user interaction from the victim is required. Because the flaw is a logic error in server-side authorization, exploitation does not depend on payload obfuscation or bypass of client-side controls. Review the affected handler around line 162 of masquerade.php in the WordPress Plugin Code Review and the technical breakdown in the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2024-9522

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with the action parameter set to the masquerade handler originating from non-administrator accounts.
Unexpected authenticated sessions for administrator accounts immediately following requests from subscriber-level users.
New administrator accounts, plugin installations, or theme modifications shortly after masquerade AJAX traffic in access logs.

Detection Strategies

Correlate WordPress user role information with admin-ajax.php request logs to flag subscriber-level accounts invoking privileged actions.
Enable WordPress audit logging (via a plugin such as WP Activity Log) and alert on user switching events initiated by non-administrator roles.
Hunt in web server logs for the ajax_masq_login action name paired with the user_id parameter targeting known administrator IDs.

Monitoring Recommendations

Monitor for privilege escalation patterns in which a session cookie for user ID 1 or another administrator ID is issued to an IP previously seen authenticated as a subscriber.
Track outbound changes to wp_users and wp_usermeta tables and alert on capability grants originating from AJAX requests.
Review installed WordPress plugins during patch cycles and ensure the WP Users Masquerade plugin version is above 2.0.0 once a fixed release becomes available.

How to Mitigate CVE-2024-9522

Immediate Actions Required

Deactivate and remove the WP Users Masquerade plugin on any WordPress site running version 2.0.0 or earlier until a patched release is available.
Disable open user registration (Settings > General > Anyone can register) to reduce the pool of accounts that can reach the vulnerable endpoint.
Force a password reset and session invalidation for all administrator accounts if the plugin was active and exposed to untrusted users.

Patch Information

At the time of publication, no fixed version of the WP Users Masquerade plugin is listed in the NVD entry for CVE-2024-9522. Site operators should consult the plugin's WordPress.org listing and the Wordfence Vulnerability Analysis for updated remediation guidance and to confirm when a version above 2.0.0 addresses the authentication bypass.

Workarounds

Restrict access to /wp-admin/admin-ajax.php at the web application firewall (WAF) layer to block requests carrying the masquerade action parameter from non-administrator sessions.
Apply the principle of least privilege by auditing existing accounts and removing subscriber or contributor accounts that are not strictly required.
Enforce multi-factor authentication on all administrator accounts so that a hijacked session alone cannot be used to make further privileged changes through the WordPress UI.

bash

# Configuration example: temporarily disable the plugin via WP-CLI
wp plugin deactivate wp-users-masquerade
wp plugin delete wp-users-masquerade

# Disable open registration until the plugin is patched
wp option update users_can_register 0