WooCommerce Plugin Allows Unauthenticated Admin Account Takeover

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing an authenticated attacker to log in as any WordPress Administrator by directly supplying an Administrator's user ID to the wpcsa_login endpoint and receiving a full Administrator session cookie without supplying the Administrator's password. This makes it possible for authenticated attackers to perform a direct session takeover, gaining full Administrator-level access to the site.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WPC Shop as a Customer for WooCommerce plugin contains a critical privilege escalation vulnerability affecting all versions up to 2.0.0. The plugin's wpcsa_login endpoint fails to properly validate user roles before issuing authentication session cookies, allowing any authenticated attacker to assume Administrator privileges by supplying an admin user ID. This vulnerability is particularly dangerous because it requires minimal effort—an attacker only needs valid site access and knowledge of an admin account ID to completely compromise WordPress installations. Any site running this plugin with active user registrations faces immediate risk of total administrative takeover, data theft, and malware injection.

Casky's 224 matched security skills leverage Claude's extended reasoning to detect the attack patterns underlying this CWE-269 (Improper Access Control) vulnerability, which maps to MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky would observe detection findings focused on unauthorized session elevation: anomalous authentication logs showing low-privilege users receiving Administrator cookies, endpoint abuse patterns targeting wpcsa_login with varying user IDs, and role validation bypasses in plugin authentication handlers. The platform's skills would flag the absence of proper authorization checks before session issuance, helping security teams identify similar CWE-269 patterns across their WordPress ecosystem before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-95687.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-95687

Casky has 224 skills that investigate the attack patterns behind CVE-2026-95687. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn