Description
The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.66. This is due to missing authorization in the `submit()` function, which allows unauthenticated form submissions to control the target user ID before calling `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite any WordPress user's email address and password, including an administrator's, and take over the account. Successful exploitation requires a public ACPT user form that permits anonymous submissions.
Published: 2026-09-04
Score: 9.8 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The ACPT (Premium) WordPress plugin is vulnerable to privilege escalation in all versions up to and including 2.0.66. Because the submit() function omits authorization checks, an unauthenticated user can submit a form that sets the target user ID and then triggers wp_update_user(). This allows the attacker to overwrite any WordPress user's email address and password, including that of an administrator, effectively taking over the account. The flaw is a direct result of missing authorization, corresponding to CWE‑269.

Affected Systems

Mauro Cassani’s ACPT (Premium) plugin for WordPress. Versions 2.0.66 and earlier are affected. No other vendors or products are listed.

Risk and Exploitability

The CVSS score of 9.8 indicates critical severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the flaw requires only an unauthenticated HTTP request to a publicly reachable form that permits anonymous submissions. The vulnerability is not listed in the CISA KEV catalog, but its impact and high CVSS make it a high‑risk target. Attackers can gain full control over any user account, leading to complete compromise of the affected WordPress site.

Generated by OpenCVE AI on September 4, 2026 at 08:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update ACPT (Premium) to the latest version (≥2.0.67) where the authorization check has been restored.
  • If an immediate update is not possible, disable anonymous form submissions or remove the publicly accessible form that allows acpt_form_post_id to be set by untrusted users.
  • After the fix, review account activity logs for any unauthorized changes and enforce stricter password policies to minimize the impact of a future compromise.

Generated by OpenCVE AI on September 4, 2026 at 08:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 07:00:00 +0000

Type Values Removed Values Added
Description The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.66. This is due to missing authorization in the `submit()` function, which allows unauthenticated form submissions to control the target user ID before calling `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite any WordPress user's email address and password, including an administrator's, and take over the account. Successful exploitation requires a public ACPT user form that permits anonymous submissions.
Title ACPT (Premium) <= 2.0.66 - Unauthenticated Privilege Escalation via 'acpt_form_post_id' Parameter
Weaknesses CWE-269
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-09-04T06:40:26.391Z

Reserved: 2026-07-10T00:10:11.358Z

Link: CVE-2026-15354

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T07:17:08.487

Modified: 2026-09-04T07:17:08.487

Link: CVE-2026-15354

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T08:30:16Z

Weaknesses
  • CWE-269

    Improper Privilege Management