Authentication vulnerability in Browse As 0.2

A plugin called Browse As for WordPress has a security issue in versions 0.2 and below. The problem is that the plugin does not properly check for authentication when using the ‘IS_BA_Browse_As::notice’ function with the ‘is_ba_original_user_COOKIEHASH’ cookie value. This means that anyone who is already logged in and has at least subscriber-level permissions can log in as any other user on the website, even an administrator, as long as they have the user’s ID number.