WPC Shop as a Customer Flaw: Update Now

If your WooCommerce store runs the WPC Shop as a Customer plugin at version 2.0.0 or older, update it now, because a flaw (CVE-2026-95687) lets a logged-in user with a low-level account become a full store administrator without knowing the admin's password.

This post is for store owners, agencies and freelancers who manage WooCommerce sites and are not security specialists. You will learn what the bug is, who is exposed, the exact steps to fix it, and how to check whether someone already abused it on your site.

What happened, in plain English

WPC Shop as a Customer for WooCommerce is a WordPress plugin. It lets store staff "shop as" a customer, for example to place a phone order on a customer's behalf. To do that, the plugin has to switch your login session to another user.

According to the NVD record for CVE-2026-95687, published on 2026-10-01, the plugin does not check what role the target user has before it creates that new session. An attacker who is logged in with a low-privilege account can send an administrator's user ID to the plugin's wpcsa_login endpoint. The site then hands back a full Administrator login cookie. No password is needed.

A session cookie is the small file your browser keeps after you log in so the site knows who you are. If an attacker gets an administrator's session cookie, the site treats them as that administrator.

How serious is it?

The NVD lists the severity as High, with a CVSS score of 8.8 (vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). CVSS is a standard 0 to 10 scale for rating how bad a flaw is. Here is what the vector means in everyday terms:

• AV:N means it can be attacked over the internet.
• AC:L means it is not hard to pull off.
• PR:L means the attacker needs a low-level account first. A basic logged-in account is enough.
• UI:N means no one else has to click anything.
• C:H/I:H/A:H means the impact on data, changes and availability is high.

The weakness type is CWE-269, Improper Privilege Management. That is the formal name for a program giving someone more power than they should have. Security people call the result a privilege escalation flaw: a small account turns into a powerful one.

Nothing in the NVD record says this is being exploited in the wild, so we will not claim that. But the NVD entry is public, so assume attackers can read it too.

Who is affected

The NVD description says the flaw affects all versions up to and including 2.0.0. The NVD entry does not list a separate affected-version range, so that description is the only version information we have.

Use this table to see where you stand.

That "customers can register" row matters. Most WooCommerce stores let shoppers create accounts, and a customer account would likely count as an authenticated user. The attacker does not need to be a clever outsider with special access. They likely need only an ordinary login.

The fix: update the plugin

The NVD record links to a code change on the WordPress.org plugin repository that compares version 2.0.0 against 2.0.1. That strongly suggests 2.0.1 is the release that closes the hole. The NVD text does not state a fixed version outright, so install the latest available version and read the plugin's changelog on its WordPress.org page to confirm.

Update from the dashboard

1. Take a backup of your site and database first. Your host or a backup plugin can do this in a few minutes.
2. Log in to WordPress and go to Plugins > Installed Plugins.
3. Find WPC Shop as a Customer for WooCommerce.
4. Click Update now. If you do not see an update, go to Dashboard > Updates and click Check again.
5. Confirm the version number shown under the plugin name is newer than 2.0.0.

Update with WP-CLI

WP-CLI is a command-line tool many hosts provide for managing WordPress. If you have SSH access, run these from your site's folder:

wp plugin get wpc-shop-as-customer --field=version
wp plugin update wpc-shop-as-customer
wp plugin get wpc-shop-as-customer --field=version

The first command shows your current version. The last one should show a newer one. The WP-CLI docs for plugin update cover other options.

If you cannot update right now

Deactivate the plugin until you can. In the dashboard, click Deactivate under the plugin name. Or run:

wp plugin deactivate wpc-shop-as-customer

Your store keeps working. You only lose the "shop as customer" feature for a while.

Check whether someone already used it

The flaw was published on 2026-10-01, so there has been time for abuse. Updating closes the door. It does not tell you whether someone already walked through it. Spend ten minutes on these checks.

1. Review your administrators. Go to Users > All Users and click the Administrator filter. Or run:

   wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

Every name should be someone you know. Look closely at accounts created recently.

1. Review recent changes to admin emails. An attacker with admin access may change an admin's email address so they can reset the password later. Compare each administrator's email in Users > All Users with the addresses you expect, or check the user_email column in the command output from step 1.
2. Look at your plugin list. Under Plugins > Installed Plugins, look for anything you did not install. A fake plugin is a common way to keep access.
3. Check your orders and payment settings. Under WooCommerce > Settings > Payments, make sure the payment gateway accounts and keys are yours.
4. Check your hosting or security-plugin logs for odd admin logins around unusual times or from places you do not work from. Not every host keeps these logs, so a blank log is not proof of safety.

If you find something that does not belong, do not just delete it and move on. Follow our website hacked guide to contain the problem and clean up properly.

Force everyone to log in again

Because the flaw hands out valid admin sessions, it is smart to end all existing sessions after you update. Then any session an attacker holds stops working.

The simplest way is to change your WordPress security keys and salts. These are secret strings in your wp-config.php file that protect login cookies. Generate fresh values from the official generator at https://api.wordpress.org/secret-key/1.1/salt/ and replace the eight matching lines (AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY, and the four _SALT lines). Everyone, including you, will be logged out and must sign in again.

Then do these:

• Reset the passwords of all administrator accounts.
• Turn on two-factor authentication for admins with a reputable plugin. A two-factor prompt may not stop this particular bug, because the flaw issues a session without going through the normal login step. It still protects you from the more common attack, password guessing.
• Remove admin rights from anyone who does not need them.

Reduce your risk next time

This kind of bug is not unique to one plugin. Any plugin that lets one user act as another is powerful and needs careful code. A few habits help:

• Keep plugins updated. Check for updates at least weekly, and sooner for stores with live customers.
• Delete plugins you do not use. Deactivated code is still code on your server.
• Limit open registration if you do not need it, or require email confirmation.
• Give people the lowest role that does the job. A shop manager does not need to be an administrator.
• Test updates on a staging copy if your store is busy, but do not delay security fixes for weeks.

If you are not sure what else could be exposed, our guide on whether your website is hackable walks through the common weak spots. You can also run the free website security check for a quick outside look at your site.

What an automated scan can and cannot tell you

A scanner can often spot an outdated plugin version. It is much less able to judge whether your store's roles, registration settings and custom code add up to a real risk. A person reading your setup can. If you want to understand the difference, see manual vs automated penetration testing.

Key takeaways

• CVE-2026-95687 is a high-severity (CVSS 8.8) flaw in WPC Shop as a Customer for WooCommerce, affecting all versions up to and including 2.0.0.
• A logged-in user with a low-privilege account, such as an ordinary customer account, could become a full administrator without the admin's password.
• Update to the latest version now (the code change linked from the NVD points to 2.0.1), or deactivate the plugin until you can.
• After updating, review your administrator list, plugins and payment settings, then rotate your security keys and admin passwords.
• Keep plugins current and delete the ones you do not use.

Want a human to look at your store?

Updating fixes this one flaw. It does not tell you what else is open on your site. A Bug Circuit Circuit audit is $49 one time: a real security engineer manually tests your whole site and sends a written report with severity, evidence and exact fixes. It is a focused audit for small sites, not an enterprise pentest or a compliance certificate. If you would rather start free, the passive check costs nothing and needs no card.

Primary source: NVD entry for CVE-2026-95687.