CVE-2026-95687: WPC Shop Customer Plugin Privilege Escalation

CVE-2026-95687 Overview

CVE-2026-95687 is a privilege escalation vulnerability in the WPC Shop as a Customer for WooCommerce plugin for WordPress. The plugin fails to validate the target user's role before issuing a new authentication session through the wpcsa_login endpoint. An authenticated attacker can supply any user ID, including an Administrator's, and receive a valid session cookie without providing a password. All versions up to and including 2.0.0 are affected, with the issue remediated in 2.0.1.

Critical Impact
Any authenticated low-privileged user can perform a full session takeover of a WordPress Administrator account, resulting in complete site compromise.

Affected Products

WPC Shop as a Customer for WooCommerce plugin for WordPress
Versions up to and including 2.0.0
Fixed in version 2.0.1

Discovery Timeline

2026-10-01 - CVE-2026-95687 published to NVD
2026-10-03 - Last updated in NVD database

Technical Details for CVE-2026-95687

Vulnerability Analysis

The flaw sits in the plugin's wpcsa_login endpoint, which is intended to let a shop operator impersonate a customer account for support purposes. The endpoint accepts a user ID parameter and establishes a WordPress authentication session for that user. The handler does not verify that the target user ID belongs to a customer-level role, nor does it enforce a role allowlist on the impersonation target. By supplying the user ID of any Administrator, the attacker receives a signed authentication cookie bound to that Administrator account. Full access to the WordPress dashboard, plugin and theme editors, user management, and the underlying filesystem follows directly from that session.

Root Cause

The root cause is improper privilege management [CWE-269]. The impersonation handler validates that the caller is authenticated but omits a check on the role of the user being impersonated. The correct pattern restricts the target set to users with the customer role and rejects any request targeting a user with manage_options or administrator capabilities. The fix landed in WordPress plugin changeset 3708414 for the 2.0.1 tag.

Attack Vector

Exploitation requires an authenticated session on the WordPress site. On WooCommerce deployments this bar is low because customer registration is typically open. The attacker enumerates or guesses Administrator user IDs (user ID 1 is the common default) and issues a request to the wpcsa_login endpoint with that ID. The server returns a WordPress authentication cookie for the Administrator. The attacker replays that cookie and operates as the Administrator. No password, nonce bypass, or second factor interaction is required beyond the initial authenticated request. See the Wordfence Vulnerability Intelligence entry and the WordPress Changeset Comparison for the specific code paths.

Detection Methods for CVE-2026-95687

Indicators of Compromise

Requests to the wpcsa_login endpoint originating from low-privileged customer accounts.
New or unexpected Administrator sessions appearing immediately after a wpcsa_login request in access logs.
Creation of new Administrator-level users, plugin installations, or theme file edits following a wpcsa_login call.
Authentication cookies issued for Administrator user IDs where the originating request was authenticated as a non-Administrator.

Detection Strategies

Correlate web server access logs for wpcsa_login calls against the WordPress user role of the originating session.
Alert when a session associated with the customer role is followed by actions requiring the manage_options capability.
Monitor WordPress audit logs for Administrator logins that lack a corresponding wp-login.php POST.

Monitoring Recommendations

Enable detailed WordPress authentication logging via a security plugin or SIEM forwarder.
Forward web server and PHP error logs to a centralized analytics platform for role-change and privilege-escalation queries.
Baseline normal usage of the wpcsa_login endpoint and alert on calls that target user IDs outside the expected customer range.

How to Mitigate CVE-2026-95687

Immediate Actions Required

Update the WPC Shop as a Customer for WooCommerce plugin to version 2.0.1 or later immediately.
Audit the WordPress user list for Administrator accounts created or modified since the plugin was installed.
Rotate passwords and invalidate active sessions for all Administrator accounts.
Review installed plugins, themes, and wp-content for unauthorized file modifications.

Patch Information

The vendor released a fix in version 2.0.1 under WordPress plugin changeset 3708414. The patch adds a role check that restricts the impersonation target to the customer role and rejects requests targeting privileged users. Review the WordPress Changeset 3708414 for the exact code changes.

Workarounds

Deactivate the WPC Shop as a Customer for WooCommerce plugin until the update to 2.0.1 is applied.
Restrict access to the wpcsa_login endpoint at the web server or web application firewall layer to known administrator IP ranges.
Disable open customer registration on WooCommerce to reduce the pool of authenticated attackers.
Enforce multi-factor authentication on all Administrator accounts so that a stolen session cookie alone does not grant persistent control.

bash

# Example WAF rule to block wpcsa_login from non-admin IPs (nginx)
location ~ ^/wp-admin/admin-ajax.php {
    if ($arg_action = "wpcsa_login") {
        set $block 1;
    }
    if ($remote_addr ~ "^203\.0\.113\.(10|11|12)$") {
        set $block 0;
    }
    if ($block = 1) {
        return 403;
    }
}