CVE-2026-6456 is an improper authentication vulnerability (CWE-287) in the beycanpress Account Switcher WordPress plugin. The issue is due to the `rememberLogin` REST API endpoint using a loose comparison (`!=` instead of `!==`) for validating a secret token, combined with no check that the secret is non-empty. When a user has never used the "Remember me" feature, their secret is empty, allowing an attacker to bypass validation by sending an empty secret parameter. Additionally, all REST routes in the plugin use `permission_callback => '__return_true'` without capability checks, enabling any authenticated user with Subscriber or higher privileges to switch to any account, including administrators, effectively escalating their privileges.

An attacker with authenticated access at Subscriber level or above can exploit this vulnerability to impersonate any user, including administrators. This results in full administrative control over the WordPress site, allowing complete compromise of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — no official fix or patch is currently available from the vendor. Until a patch is released, it is recommended to disable or remove the Account Switcher plugin to prevent exploitation. Monitor the vendor advisory for updates and apply any official fixes promptly once available.