Security Alert Summary
The Debugger & Troubleshooter plugin for WordPress contains an unauthenticated privilege escalation vulnerability (CVE-2026-5130) in versions up to and including 1.3.2. The plugin accepted a cookie value directly as a user ID without cryptographic validation or authorization checks, allowing an attacker to impersonate arbitrary users. The issue was addressed in version 1.4.0 by introducing a token-based validation system that restricts user simulation to administrators and validates a random token stored in the database.
CVE Details
- CVE ID: CVE-2026-5130
- Affected plugin / component: Debugger & Troubleshooter plugin for WordPress
- Affected versions: up to and including 1.3.2 (fixed in 1.4.0)
- Published: March 30, 2026 at 11:17:04 PM UTC
- Last Modified: March 30, 2026 at 11:17:04 PM UTC
- CVSS v3.1: Base Score 8.8 (HIGH) —
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Authentication / Privileges / User Interaction: Authentication: None (unauthenticated attackers can exploit); Privileges Required: Low (PR:L); User Interaction: None (UI:N)
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- Weakness: CWE-565
Technical Details
The plugin accepted the wp_debug_troubleshoot_simulate_user cookie value directly as a user ID and used it to override the determine_current_user filter without cryptographic validation or authorization checks. Because the cookie value could be set by any client, an unauthenticated attacker could set that cookie to the numeric ID of a target user and thereby impersonate that user within WordPress.
According to the disclosure, successful exploitation could allow an attacker to obtain administrator-level access. That elevated access would permit privileged actions such as creating new administrator accounts, modifying site content, installing plugins, or otherwise exercising administrative capabilities available to the impersonated account.
The fix implemented in version 1.4.0 replaces acceptance of arbitrary user IDs with a cryptographic token-based validation mechanism: only administrators can initiate user simulation, the cookie stores a random 64-character token, and tokens are validated against mappings stored in the database rather than accepting arbitrary IDs.
How This Could Impact Your Website
In a typical small organization, a site owner maintains administrator accounts, internal staff have editor or author roles, and external contractors or contributors may have lower-level roles. An attacker who can impersonate an administrator by setting the vulnerable cookie could perform administrator actions while appearing to be that administrator. Practical consequences include the creation of new administrator accounts, unauthorized content changes, plugin installation or removal, and exposure of user data tied to administrator access.
Exposure of internal user information such as email addresses increases the risk of targeted phishing or social engineering against staff and contractors. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available (the fix is documented in version 1.4.0).
- Review and reduce unnecessary user roles, especially contributors and other low-privilege accounts that could be targeted for impersonation.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, such as unexpected administrator logins or new admin accounts.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/debugger-troubleshooter/tags/1.3.2/debug-troubleshooter.php#L827
- https://plugins.trac.wordpress.org/browser/debugger-troubleshooter/tags/1.3.2/debug-troubleshooter.php#L849
- https://plugins.trac.wordpress.org/changeset/3486202/debugger-troubleshooter/trunk/debug-troubleshooter.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3e037931-870f-45eb-973c-0276911682ad?source=cve
