HIGHCVSS 8.8

CVE-2026-93548

CVE-2026-93548 updated by NVD

Modified: 2026-10-11
Sources: nvd

Summary

The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales WordPress plugin before 1.43.3 act as an arbitrary other user, including an administrator, resulting in that user's account details being exposed and their account being taken over.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-93548

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.