CVE-2026-5617: WordPress Login as User Privilege Escalation

CVE-2026-5617 Overview

The Login as User plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to and including 1.0.3. The vulnerability exists in the handle_return_to_admin() function, which improperly trusts a client-controlled cookie (oclaup_original_admin) to determine user authentication without performing server-side verification. This insecure authorization bypass (CWE-639: Authorization Bypass Through User-Controlled Key) allows authenticated attackers with minimal privileges to escalate their access to administrator level.

Critical Impact

Authenticated users with Subscriber-level access or above can escalate their privileges to administrator by manipulating a client-side cookie, potentially leading to complete site compromise.

Affected Products

• Login as User plugin for WordPress version 1.0.3 and earlier
• One Click Login as User WordPress plugin (all versions through 1.0.3)
• WordPress sites with the affected plugin installed and active

Discovery Timeline

• April 15, 2026 - CVE-2026-5617 published to NVD
• April 15, 2026 - Last updated in NVD database

Technical Details for CVE-2026-5617

Vulnerability Analysis

This privilege escalation vulnerability stems from a fundamental authorization bypass flaw in the plugin's user switching mechanism. The handle_return_to_admin() function is designed to allow administrators to impersonate other users and then return to their original administrator session. However, the function relies on a client-controlled cookie named oclaup_original_admin to identify which user account to authenticate back into, without performing any server-side validation to confirm the cookie was legitimately set during an authorized admin-initiated user switch.

The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), which describes scenarios where an application uses user-controlled input to directly access objects or make authorization decisions without proper validation.

Root Cause

The root cause lies in the absence of server-side session tracking for the user switching operation. When an administrator legitimately switches to another user account, the plugin stores the original admin's user ID in a client-side cookie. However, since cookies can be freely manipulated by the client, any authenticated user can forge this cookie value to reference an administrator's user ID. The plugin fails to maintain a secure server-side record to verify that a legitimate switch operation occurred, allowing attackers to exploit the "Return to Admin" functionality to assume administrative privileges.

Attack Vector

The attack requires only low-privilege authenticated access (Subscriber-level or above) and can be executed remotely over the network without any user interaction. An attacker follows this exploitation path:

1. The attacker obtains a valid Subscriber-level (or higher) account on the target WordPress site
2. The attacker identifies or enumerates an administrator's user ID (commonly user ID 1)
3. The attacker manually sets the oclaup_original_admin cookie to the target administrator's user ID
4. The attacker triggers the "Return to Admin" functionality exposed by the plugin
5. The handle_return_to_admin() function reads the forged cookie value and authenticates the attacker as the administrator
6. The attacker now has full administrative access to the WordPress site

The vulnerable code can be examined in the WordPress Plugin Source Code at line 45 and line 50 of the class-login-handler.php file. For additional technical details, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-5617

Indicators of Compromise

• Unexpected administrator session creations from users who previously had Subscriber-level access
• Presence of oclaup_original_admin cookies with administrator user IDs in web server logs from non-administrator users
• User role changes in WordPress audit logs without corresponding admin panel activity
• Suspicious plugin-triggered authentication events in security logs

Detection Strategies

• Monitor WordPress authentication logs for privilege escalation patterns, particularly "Return to Admin" actions from non-admin user sessions
• Implement file integrity monitoring on WordPress core and plugin directories to detect unauthorized changes following privilege escalation
• Deploy web application firewall (WAF) rules to detect and alert on suspicious cookie manipulation attempts targeting oclaup_original_admin
• Enable SentinelOne's application control and behavioral analysis to identify anomalous WordPress process activity

Monitoring Recommendations

• Review WordPress user activity logs daily for unauthorized administrative actions
• Configure alerts for new administrator account creation or existing account privilege modifications
• Monitor HTTP request logs for unusual patterns accessing the "Return to Admin" endpoint with suspicious cookie values
• Implement centralized logging with SentinelOne Singularity Data Lake to correlate WordPress security events across your environment

How to Mitigate CVE-2026-5617

Immediate Actions Required

• Immediately deactivate and remove the Login as User plugin (One Click Login as User) from all WordPress installations
• Audit all user accounts for unauthorized privilege escalations and demote any suspicious administrator accounts
• Force password resets for all administrator accounts as a precautionary measure
• Review WordPress audit logs for evidence of exploitation and investigate any suspicious activity

Patch Information

As of the published date, no patched version of the Login as User plugin has been released to address CVE-2026-5617. The vulnerability affects version 1.0.3 and all prior versions. Organizations should monitor the WordPress Plugin Directory for security updates. Until a patch is available, complete removal of the plugin is the recommended remediation.

Workarounds

• Remove the Login as User plugin entirely until a security patch is released by the vendor
• Implement strict access controls limiting who can register for accounts on WordPress sites where complete plugin removal is not immediately feasible
• Deploy a Web Application Firewall (WAF) rule to block requests containing the oclaup_original_admin cookie from non-administrator sessions
• Consider alternative user switching plugins that implement proper server-side session validation

# WordPress CLI commands to identify and remove the vulnerable plugin
# List installed plugins and check for the vulnerable plugin
wp plugin list --status=active | grep -i "login-as-user\|one-click-login"

# Deactivate the vulnerable plugin
wp plugin deactivate one-click-login-as-user

# Remove the vulnerable plugin completely
wp plugin delete one-click-login-as-user

# Audit current user roles for unauthorized administrators
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered