CVE-2026-93548: FooSales < 1.43.3 - Subscriber+ Privilege Escalation via User Impersonation
The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales WordPress plugin before 1.43.3 act as an arbitrary other user, including an administrator, resulting in that user's account details being exposed and their account being taken over.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user can exploit it, including users with Subscriber-level access or higher. The attacker does not need to already have administrative privileges.
What access can an attacker obtain?
The plugin can be made to act as an arbitrary named user, including an administrator. This can expose the targeted user's account details and result in takeover of that account.
Which installations are affected?
FooSales WordPress plugin versions before 1.43.3 are affected. Updating to version 1.43.3 or later addresses the affected version range.