CVE-2026-14566
MediumCVSS 4.3Summary
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order. This allows any authenticated user such as a subscriber to tamper with the custom metadata of orders belonging to other customers.
Risk Assessment
An authenticated low-privilege user can modify other customers' order metadata, compromising data integrity and potentially leading to order fulfillment errors or fraud. This undermines trust in the ordering process.
Recommendation
Update the advanced-customized-prompts plugin to a version later than 1.0.1 or remove it if unused. Verify the integrity of order metadata.
Other vulnerabilities in advanced-customized-prompts WordPress plugin
See all- CVE-2026-14565Medium
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output. This allows any authenticated user such as a subscriber to store JavaScript that executes in the browser of visitors viewing the affected product.
- CVE-2026-14563Critical
The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to create arbitrary new accounts.
Original NVD description (English source)
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belonging to other customers.