CVE-2024-43311: Privilege Escalation in Login As Users

The Improper Privilege Management vulnerability allows an attacker to bypass access controls and assume the privileges of other users, potentially including administrators. Successful exploitation could lead to complete compromise of a WordPress site, enabling attackers to modify content, install malicious plugins, steal user credentials, or deface the website. The impact is particularly severe given the plugin's function – allowing users to log in as others – which, when combined with privilege escalation, creates a highly exploitable scenario. This could be leveraged to gain access to sensitive data or perform actions on behalf of other users without authorization.

1. Reserved2024-08-09
2. Published2024-08-19
3. Modified2024-08-22
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-43311 is to immediately upgrade the Login As Users plugin to version 1.4.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin to prevent exploitation. While a direct workaround is unavailable, implementing strict user access controls and regularly auditing user permissions can help limit the potential damage if the vulnerability is exploited. Review WordPress user roles and permissions to ensure least privilege is enforced.