** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-32566. Reason: This candidate is a reservation duplicate of CVE-2026-32566 Notes: All CVE users should reference CVE-2026-32566 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Description
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-32566. Reason: This candidate is a reservation duplicate of CVE-2026-32566 Notes: All CVE users should reference CVE-2026-32566 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Published:
2026-09-04
Score:
n/a
EPSS:
n/a
KEV:
No
Impact:
n/a
Action:
n/a
Analysis
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
No reference.
History
Fri, 16 Oct 2026 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-269 | |
| References |
|
|
| Metrics |
cvssV3_1
|
Fri, 16 Oct 2026 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.66. This is due to missing authorization in the `submit()` function, which allows unauthenticated form submissions to control the target user ID before calling `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite any WordPress user's email address and password, including an administrator's, and take over the account. Successful exploitation requires a public ACPT user form that permits anonymous submissions. | ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-32566. Reason: This candidate is a reservation duplicate of CVE-2026-32566 Notes: All CVE users should reference CVE-2026-32566 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. |
Fri, 04 Sep 2026 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Fri, 04 Sep 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Mauro Cassani
Mauro Cassani acpt (premium) Wordpress Wordpress wordpress |
|
| Vendors & Products |
Mauro Cassani
Mauro Cassani acpt (premium) Wordpress Wordpress wordpress |
Fri, 04 Sep 2026 07:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.66. This is due to missing authorization in the `submit()` function, which allows unauthenticated form submissions to control the target user ID before calling `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite any WordPress user's email address and password, including an administrator's, and take over the account. Successful exploitation requires a public ACPT user form that permits anonymous submissions. | |
| Title | ACPT (Premium) <= 2.0.66 - Unauthenticated Privilege Escalation via 'acpt_form_post_id' Parameter | |
| Weaknesses | CWE-269 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: REJECTED
Assigner: Wordfence
Published:
Updated: 2026-10-16T18:49:57.076Z
Reserved: 2026-07-10T00:10:11.358Z
Link: CVE-2026-15354
Vulnrichment
Updated: 2026-09-04T18:36:28.935Z
NVD
Status : Rejected
Published: 2026-09-04T07:17:08.487
Modified: 2026-10-16T19:17:05.913
Link: CVE-2026-15354
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.