Customer-to-Administrator escalation via insecure operator resolution

Privilege escalation in Customer Switching for WooCommerce before 2.1.3 allows remote authenticated users to take over administrator accounts. The switching flow resolves an active impersonation session as its initiating operator without binding that session to the currently authenticated customer. Exploitation requires an operator to remain switched into the attacker's customer account; that customer can then submit a valid nonce and target administrator ID.