CVE-2026-14563
CriticalCVSS 9.8Summary
The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to create arbitrary new accounts.
Risk Assessment
An attacker can take full control of the WordPress site by logging in as an administrator without knowing the password. This leads to complete site takeover and the ability to perform arbitrary actions.
Recommendation
Immediately update the advanced-customized-prompts plugin to a fixed version or disable and remove it. Check logs for unauthorized logins and created accounts.
Other vulnerabilities in advanced-customized-prompts WordPress plugin
See all- CVE-2026-14566Medium
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order. This allows any authenticated user such as a subscriber to tamper with the custom metadata of orders belonging to other customers.
- CVE-2026-14565Medium
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output. This allows any authenticated user such as a subscriber to store JavaScript that executes in the browser of visitors viewing the affected product.
Original NVD description (English source)
The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to create arbitrary new accounts.