Advanced Members for ACF: Privilege Escalation via Password Overwrite (CVE-2026-116624)

The Advanced Members for ACF WordPress plugin (versions 1.3.0 and below) is vulnerable to privilege escalation via the [advanced-members-account-password] shortcode. An operator-precedence bug in the pre_update_value function within acf/fields/class-user-password.php causes the system to incorrectly authorize password updates by defaulting the $user_id to boolean true, which evaluates to ID 1 via PHP loose equality. Additionally, a flaw in the amem_save_all_fields function fails to respect field exclusion guards, allowing the password update to proceed even if the application expects it to be blocked.

Attack Chain

1. Attacker authenticates to a WordPress site as a user with at least Subscriber-level access.
2. Attacker navigates to a page containing the [advanced-members-account-password] shortcode.
3. Attacker submits the form containing the acf[_amem_local_user_password] parameter.
4. The plugin's pre_update_value function processes the request and hits the PHP operator-precedence bug.
5. The authorization logic incorrectly evaluates $user_id as boolean true, bypassing the _can_edit() check.
6. The system executes wp_update_user(), targeting user ID 1 due to type casting of the boolean ID.
7. The amem_save_all_fields function overrides the exclusion guard, ensuring the malicious password change is processed.
8. The administrator account password is overwritten with the attacker-provided value, granting full administrative access.

Impact

Authenticated users with low-level privileges can gain full administrative access to the WordPress site, leading to potential data exfiltration, site defacement, or total system compromise.

Recommendation

• Identify all WordPress sites utilizing the Advanced Members for ACF plugin.
• Update to a version beyond 1.3.0 immediately when a patch becomes available.
• Disable the [advanced-members-account-password] shortcode or restrict access to administrative-only pages until a patch is applied.
• Audit user management logs for unexpected password change events for administrator accounts.