CVE-2026-15240 is an improper authentication vulnerability (CWE-287) in the Customer Switching WordPress plugin prior to version 2.1.3. The plugin fails to securely bind an active user-switching session to the operator who initiated it. As a result, a lower-privileged account that an operator has switched into can be treated as the operator, enabling that account to switch into any other permitted account, including administrators. This can lead to full account takeover by unauthorized users.

Successful exploitation allows a lower-privileged user to escalate privileges by switching into any permitted account, including administrator accounts, resulting in full account compromise. This impacts confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor the vendor's official channels for updates and apply any official fixes once available. Until then, restrict use of the plugin to trusted users and consider disabling it if possible.