CVE-2026-93548
Received Received - Intake

Authentication Bypass in FooSales WordPress Plugin

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: WPScan

Description
The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales WordPress plugin before 1.43.3 act as an arbitrary other user, including an administrator, resulting in that user's account details being exposed and their account being taken over.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2026-93548
EUVD
EUVD-2026-95508

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown FooSales 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-93548 is an authentication bypass vulnerability in the FooSales WordPress plugin versions before 1.43.3. It allows any authenticated user, even with low privileges like Subscribers, to impersonate other users including administrators by exploiting insufficient authorization checks in the plugin.

Detection Guidance

Check the installed version of the FooSales WordPress plugin. If it is below 1.43.3, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive account details and complete account takeover of any user, including administrators. Attackers could steal personal data, modify account settings, or perform actions on behalf of the compromised user.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive user data and account takeover risks. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. The flaw allows attackers to impersonate users, potentially exposing confidential data.

Mitigation Strategies

Update the FooSales plugin to version 1.43.3 or later immediately. If updating is not possible, consider disabling the plugin until an update is applied to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93548. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart