WordPress Fast User Switching plugin <= 1.4.10 - Cross Site Request Forgery (CSRF) vulnerability

The CSRF vulnerability in Tikweb Management Fast User Switching allows an attacker to craft malicious requests that appear to originate from a legitimate user. If successful, an attacker could modify user settings, delete data, or perform other administrative actions without the user's knowledge or consent. The impact is amplified if the user possesses elevated privileges within the system. This could lead to a complete compromise of the Tikweb Management Fast User Switching instance and potentially the underlying WordPress site it is integrated with.

Websites utilizing Tikweb Management Fast User Switching, particularly those with shared hosting environments, are at increased risk. Users with administrative privileges are especially vulnerable, as an attacker could leverage this vulnerability to gain control of the entire system.

• wordpress / composer / npm:

grep -r 'fast-user-switching' /var/www/html/

• generic web:

curl -I https://your-tikweb-site.com/fast-user-switching/ | grep -i 'csrf-token'

1. 2025-12-24Disclosure

   disclosure

1. Reserviert2025-12-19
2. Veröffentlicht2025-12-24
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

Until a patch is available, several mitigation strategies can be employed. Implement strict input validation and output encoding to prevent malicious scripts from being injected. Consider using a Web Application Firewall (WAF) with CSRF protection rules to filter out suspicious requests. Additionally, enforce strong password policies and enable multi-factor authentication for all user accounts. Regularly review access logs for any unusual activity. After upgrading to a patched version, verify the fix by attempting to trigger a CSRF attack and confirming that the request is blocked.

Aktive Installationen

2KNische

Plugin-Bewertung