CVE-2026-93548 — FooSales < 1.43.3 - Subscriber+ Privilege Escalation via User Impersonation

CVE-2026-93548

FooSales < 1.43.3 - Subscriber+ Privilege Escalation via User Impersonation PUBLISHED

Description (CNA)

The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales WordPress plugin before 1.43.3 act as an arbitrary other user, including an administrator, resulting in that user's account details being exposed and their account being taken over.

Affected (CNA)

Vendor / product	Versions
Unknown / FooSales	affected 0 before 1.43.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/7d9238eb-f56e-49db-a804-7505f59fca5c/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.