CVE-2026-93548: high-severity vulnerability in FooSales
FooSales < 1.43.3 - Subscriber+ Privilege Escalation via User Impersonation
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.8epss 0.2%
The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales WordPress plugin before 1.43.3 act as an arbitrary other user, including an administrator, resulting in that user's account details being exposed and their account being taken over.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · FooSalespublic PoCs found — 1
cve_referencewpscan.com/vulnerability/7d9238eb-f56e-49db-a804-7505f59fca5c/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.