The Login as User plugin for WordPress contains a privilege escalation vulnerability (CVE-2026-5617) due to improper authorization checks in the handle_return_to_admin() function. This function relies on a client-controlled cookie (oclaup_original_admin) to determine the user context for authentication without server-side validation that the cookie was legitimately set during an admin-initiated user switch. Consequently, an authenticated attacker with Subscriber-level or higher privileges can set this cookie to an administrator's user ID and escalate their privileges to administrator by using the 'Return to Admin' functionality. The vulnerability affects all versions up to and including 1.0.3. No patch or official remediation has been disclosed as of the published date.

An attacker with authenticated access at Subscriber level or above can exploit this vulnerability to escalate privileges to administrator. This results in full control over the affected WordPress site, including the ability to modify content, install plugins, change configurations, and potentially compromise the entire site. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to trusted users only and consider disabling or removing the vulnerable plugin to prevent exploitation.