Unauthenticated Privilege Escalation in ACPT Premium Plugin

The ACPT (Premium) plugin for WordPress is vulnerable to a critical privilege escalation vulnerability, assigned CVE-2026-15354, affecting all versions up to and including 2.0.66. The flaw exists within the plugin's submit() function, which fails to verify user authorization before executing account update operations. By interacting with a public-facing ACPT form, an unauthenticated attacker can manipulate the target user ID parameter passed to the wp_update_user() function. This allows the attacker to arbitrarily modify the email address and password of any registered user on the WordPress site. If the target is an administrator, this results in a full site takeover. Organizations using this plugin should immediately update to a patched version once available or disable public-facing forms managed by the plugin.

Attack Chain

1. Attacker identifies a WordPress site utilizing the ACPT Premium plugin with a public-facing user form enabled.
2. Attacker interacts with the public form to capture the request structure intended for the submit() function.
3. Attacker crafts a malicious HTTP POST request targeting the submit() function endpoint.
4. Attacker injects a target user ID (e.g., ID 1 for the default administrator) into the request parameters.
5. Attacker includes a new, controlled email address and password within the request body.
6. The plugin fails to validate the request sender's authorization status.
7. The plugin executes wp_update_user() using the attacker-supplied parameters.
8. Attacker gains unauthorized administrative access to the WordPress site using the updated credentials.

Impact

Successful exploitation allows unauthenticated attackers to perform a full site takeover by hijacking administrative accounts. This leads to the potential for data exfiltration, total site defacement, and the deployment of additional backdoors or malware within the WordPress environment.

Recommendation

• Immediately audit WordPress instances for public-facing forms generated by the ACPT plugin and disable them until the plugin is patched.
• Monitor web server logs for suspicious POST requests targeting common plugin submission endpoints if available in documentation.
• Apply the vendor-provided security update for ACPT Premium as soon as it is released.