Account Switcher for WordPress CVE-2026-6456: Brief Summary of a Privilege Escalation via REST API Authentication Bypass

Introduction

A loose PHP comparison operator and a missing empty-value check in a WordPress plugin's REST API are all it takes for a Subscriber to become an Administrator. CVE-2026-6456 affects the Account Switcher plugin for WordPress. A logic flaw in secret validation lets any low-privilege authenticated user impersonate any other user on the site, including full Administrators, with no user interaction.

The Account Switcher plugin, developed by BeycanPress LLC, lets WordPress administrators quickly switch between user accounts for testing and management. It was published on the WordPress.org directory in March 2025. What makes this plugin a sharp case is that its job, switching user contexts, is the vulnerable surface itself. The bypass lands straight on the mechanism meant to do the switching.

Technical Information

CVE-2026-6456 comes from two independent coding failures that combine into a complete authentication bypass chain. Each component is covered below, followed by the full attack flow.

Unrestricted REST API Routes

All REST routes registered by the Account Switcher plugin use the following permission callback configuration in app/PluginHero/BaseAPI.php:

permission_callback => '__return_true'

The __return_true function is a WordPress utility that returns true unconditionally. As a permission_callback, it means WordPress runs no capability or role check before a request reaches the endpoint handler. Any authenticated user, whether Subscriber, Contributor, Author, Editor, or Administrator, can call any of the plugin's REST endpoints.

This is in the plugin source at BaseAPI.php line 54.

Loose Secret Validation in the rememberLogin Endpoint

The rememberLogin REST API endpoint, at app/RestAPI.php:111, validates a secret value before granting access to a target user account. The code compares the submitted secret against the stored value with the loose comparison operator != instead of the strict operator !==. It also never checks that the submitted secret is non-empty.

This is in the plugin source at RestAPI.php line 111.

The Empty Meta Precondition

The exploit depends on a specific but common condition. When a target user has never used the plugin's "Remember me" feature, their asSecret user meta key does not exist in the WordPress database. In WordPress, calling get_user_meta() for a nonexistent single meta key returns an empty string ('').

An attacker exploits this by sending a request to the rememberLogin endpoint with an empty secret parameter. The loose comparison then evaluates:

'' != ''

In PHP, this expression evaluates to false. Because the validation checks whether the secret does not match (using !=), a false result means the check passes, and the code proceeds as if the secret were valid.

After the bypass, the endpoint calls wp_set_auth_cookie() for the target user, which generates a fully valid WordPress authentication cookie and delivers it to the attacker.

Full Attack Flow

1. The attacker authenticates to the WordPress site with a Subscriber (or higher) account.
2. The attacker identifies the user ID of a target Administrator. User IDs in WordPress are often predictable, since the first admin account is typically user ID 1.
3. The attacker sends a REST API request to the rememberLogin endpoint with the target user ID and an empty secret parameter.
4. The plugin retrieves the target user's asSecret meta value via get_user_meta(). Because the target has never used the "Remember me" feature, the function returns an empty string.
5. The loose comparison '' != '' evaluates to false, and the secret validation passes.
6. The endpoint calls wp_set_auth_cookie() for the target user ID, issuing a valid session cookie in the HTTP response.
7. The attacker is now fully authenticated as the target Administrator, with complete control over the WordPress installation.

The table below summarizes the key evidence points in the exploit chain:

The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network accessibility, low attack complexity, low privilege requirements, no user interaction, and high impact to confidentiality, integrity, and availability.

Affected Systems and Versions

All versions of the Account Switcher plugin for WordPress up to and including version 1.0.2 are affected. Version 1.0.2 is the latest release. No patched version exists.

The vulnerability requires:

• The Account Switcher plugin installed and active on the WordPress site.
• An attacker with an authenticated account at Subscriber level or higher.
• A target user account that has never used the plugin's "Remember me" feature, so the asSecret user meta key does not exist for that user.

The WordPress plugin directory closed the Account Switcher plugin on May 14, 2026, pending a full review. The plugin is no longer available for download from the official repository.

References

• Wordfence Vulnerability Advisory: Account Switcher <= 1.0.2 Authentication Bypass to Privilege Escalation
• NVD Entry for CVE-2026-6456
• CVE Record: CVE-2026-6456
• WordPress Plugin Directory: Account Switcher
• Plugin Source: RestAPI.php Line 111
• Plugin Source: BaseAPI.php Line 54
• BeycanPress LLC WordPress Profile