CVE-2026-5130 - Vulnerability Analysis

Overview

WordPress Debugger & Troubleshooter plugin <= 1.3.2 contains an unauthenticated privilege escalation caused by accepting wp_debug_troubleshoot_simulate_user cookie as user ID without validation, letting unauthenticated attackers impersonate any user including administrators, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can gain administrator access, allowing full site control including content modification and plugin installation.

Mitigation

Update to version 1.4.0 or later.

References

• https://plugins.trac.wordpress.org/browser/debugger-troubleshooter/tags/1.3.2/debug-troubleshooter.php#L827
• https://plugins.trac.wordpress.org/browser/debugger-troubleshooter/tags/1.3.2/debug-troubleshooter.php#L849
• https://plugins.trac.wordpress.org/changeset/3486202/debugger-troubleshooter/trunk/debug-troubleshooter.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3e037931-870f-45eb-973c-0276911682ad?source=cve

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 30, 2026

🟠 CVE-2026-5130 - High (8.8) The Debugger & Troubleshooter plugin for WordPress was vulnerable to Unauthenticated Privilege Escalation in versions up to and including 1.3.2. This was due to the plugin accepting the wp_debug_troubleshoot_simulate_user cookie value directly as ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5130/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner