The Account Switcher plugin for WordPress is vulnerable to Privilege Escalation in all versions up to

CVE-2026-6456 affects the WordPress Account Switcher plugin in all versions through 1.0.2. The vulnerable flow sits in the plugin's rememberLogin REST endpoint: it accepts an attacker-controlled secret, compares it loosely, and fails open when the target user's asSecret metadata is empty. Combined with REST routes exposed via permissive callbacks, a Subscriber-level user can mint an authenticated session for another user, including an Administrator.

The vendor-style 8.8/HIGH score is technically fair for *impact on a vulnerable host*, but it overstates *enterprise patch priority*. The big friction is attacker position: this is not unauthenticated internet-to-admin. It requires an existing low-privilege WordPress foothold, and the plugin itself appears niche, was closed on WordPress.org on 2026-05-14, and shows Active installations: N/A. That pushes this down from 'drop everything' to 'fix where present, especially on self-registration sites.'

Why this verdict

• Down from 8.8 because PR:L is not a footnote — the attacker must already have a WordPress account or stolen low-privilege credentials, which means this usually sits *after* initial access.
• Down again because the exposed population is narrow — WordPress.org shows the plugin is closed and Active installations: N/A, so this is not a broad internet-wide fire.
• Still MEDIUM, not LOW, because compromise is decisive once conditions are met — a single subscriber on an affected site can become full admin, which is a complete trust-boundary break for that application.

Why not higher?

If this were unauthenticated or broadly deployed, it would stay HIGH or higher because the end state is full administrator compromise. But requiring an authenticated foothold and a niche plugin sharply reduces both reachable population and attacker convenience.

Why not lower?

This is not harmless edge-case logic abuse. On a site where the plugin exists and subscribers are common, the path from low privilege to full admin is short, reliable, and operationally meaningful.

1. Disable or remove the plugin — If account-switcher is present, this is the cleanest containment because no official patched version was published in reviewed sources. For a MEDIUM verdict there is no noisgate mitigation SLA, but on public-registration or membership sites you should still remove it in the next normal change window instead of waiting for a vendor fix that may never ship.
2. Block the plugin REST route — Add a reverse-proxy or WAF rule to deny requests to the plugin's wp-json routes tied to Account Switcher. This does not replace remediation, but it is a practical stopgap when the business refuses to remove the plugin; for this MEDIUM item there is no mandatory mitigation deadline, so use the next safe web-tier deploy.
3. Turn off self-registration where possible — The exploit chain needs a Subscriber foothold. If the site does not truly need public user creation, disabling native registration removes the easiest path to the required attacker position; make this part of the same remediation effort within the 365-day window.
4. Audit and prune low-privilege accounts — Reset stale subscriber credentials, disable dormant accounts, and review identity sources feeding WordPress. This shrinks the only prerequisite that really matters here: valid low-privilege login access.
5. Enable WordPress audit logging — Log admin logins, role changes, plugin installs, theme edits, and unusual REST access so you can catch successful abuse quickly. For a MEDIUM finding this is hardening, not a formal mitigation SLA item, but it should be bundled with your normal WordPress control baseline.

Run this on the target WordPress host or from your config-management agent with read access to the web root; no root is required. Invoke it as bash verify-cve-2026-6456.sh /var/www/html and it will inspect wp-content/plugins/account-switcher, extract the installed version if possible, and print VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# verify-cve-2026-6456.sh
# Detects likely exposure to CVE-2026-6456 in the WordPress Account Switcher plugin.
# Exit codes:
#   0 = PATCHED / not installed
#   1 = VULNERABLE
#   2 = UNKNOWN / inspection failed

set -u

TARGET_ROOT="${1:-}"
PLUGIN_REL="wp-content/plugins/account-switcher"
AFFECTED_MAX="1.0.2"

if [[ -z "$TARGET_ROOT" ]]; then
  echo "UNKNOWN - usage: $0 /path/to/wordpress"
  exit 2
fi

PLUGIN_DIR="$TARGET_ROOT/$PLUGIN_REL"
REST_FILE="$PLUGIN_DIR/app/RestAPI.php"
BASE_FILE="$PLUGIN_DIR/app/PluginHero/BaseAPI.php"

version_lte() {
  # returns 0 if $1 <= $2
  local a="$1" b="$2"
  [[ "$(printf '%s\n%s\n' "$a" "$b" | sort -V | head -n1)" == "$a" ]]
}

extract_version() {
  local dir="$1"
  local v=""

  if [[ -f "$dir/readme.txt" ]]; then
    v=$(awk -F': *' 'BEGIN{IGNORECASE=1} /^Stable tag:/ {print $2; exit}' "$dir/readme.txt" 2>/dev/null)
    if [[ -n "$v" ]]; then
      echo "$v"
      return 0
    fi
  fi

  local phpfile
  while IFS= read -r -d '' phpfile; do
    v=$(awk -F': *' 'BEGIN{IGNORECASE=1} /^Version:/ {print $2; exit}' "$phpfile" 2>/dev/null)
    if [[ -n "$v" ]]; then
      echo "$v"
      return 0
    fi
  done < <(find "$dir" -maxdepth 1 -type f -name '*.php' -print0 2>/dev/null)

  return 1
}

if [[ ! -d "$PLUGIN_DIR" ]]; then
  echo "PATCHED - plugin not installed at $PLUGIN_DIR"
  exit 0
fi

VERSION=""
if VERSION=$(extract_version "$PLUGIN_DIR"); then
  VERSION="$(echo "$VERSION" | tr -d '[:space:]')"
fi

# Optional sanity checks for known vulnerable file layout.
HAS_LAYOUT=0
if [[ -f "$REST_FILE" && -f "$BASE_FILE" ]]; then
  HAS_LAYOUT=1
fi

if [[ -n "$VERSION" ]]; then
  if version_lte "$VERSION" "$AFFECTED_MAX"; then
    echo "VULNERABLE - Account Switcher version $VERSION installed"
    exit 1
  else
    echo "PATCHED - Account Switcher version $VERSION installed (newer than $AFFECTED_MAX)"
    exit 0
  fi
fi

if [[ $HAS_LAYOUT -eq 1 ]]; then
  echo "UNKNOWN - plugin directory present with expected vulnerable file layout, but version could not be determined"
  exit 2
fi

echo "UNKNOWN - plugin directory present, but version and file layout could not be verified"
exit 2

Sources

1. NVD CVE-2026-6456
2. Patchstack advisory for Account Switcher <= 1.0.2
3. WordPress.org plugin page
4. WordPress.org advanced view
5. Wordfence vulnerability database search result
6. CISA Known Exploited Vulnerabilities catalog
7. FIRST EPSS data statistics
8. ChoosePlugin package metadata and download count