The Advanced Members for ACF plugin contains a PHP operator‑preference bug that causes the user ID used in a password change form to resolve to the boolean true. The resulting authorization check passes for any logged‑in user, and the subsequent wp_update_user call casts the ID to integer 1, forcing the primary administrator account’s password to be overwritten. An attacker with the minimum Subscriber role can therefore supply a new password value in the acf[_amem_local_user_password] field of the [advanced-members-account-password] shortcode form and obtain full administrative control of the WordPress site. This is a classic privilege‑escalation flaw (CWE‑269) that directly compromises confidentiality, integrity and availability by allowing unauthorized modification of the site’s master account.

The flaw affects all WordPress deployments running Advanced Members for ACF version 1.3.0 or earlier. The plugin is distributed as an open‑source WordPress add‑on, so any site using the listed version range is susceptible. No specific operating‑system or PHP version is required beyond the standard WordPress environment.

With a CVSS score of 8.8 the vulnerability is considered high severity. The exploit path is straightforward: a logged‑in user simply submits the password change form with the injected parameter; no additional privileges or network access are required beyond normal subscriber access. The EPSS score is not available, but because the code is publicly visible and the vulnerability is easy to use, the likelihood of exploitation remains significant. Although the vulnerability is not listed in the CISA “Known Exploited Vulnerabilities” catalog, the easy attack surface and the fact that the attack targets the primary administrator means that attackers who have compromised a site can gain full control quickly.