{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aadvanced_members_for_acf_projectadvanced_members_for_acfwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:advanced_members_for_acf_project:advanced_members_for_acf:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-116624"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Advanced Members for ACF (\u003c= 1.3.0)"],"_cs_severities":["high"],"_cs_tags":["wordpress","privilege-escalation","web-vulnerability"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe Advanced Members for ACF WordPress plugin (versions 1.3.0 and below) is vulnerable to privilege escalation via the [advanced-members-account-password] shortcode. An operator-precedence bug in the pre_update_value function within acf/fields/class-user-password.php causes the system to incorrectly authorize password updates by defaulting the $user_id to boolean true, which evaluates to ID 1 via PHP loose equality. Additionally, a flaw in the amem_save_all_fields function fails to respect field exclusion guards, allowing the password update to proceed even if the application expects it to be blocked.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to a WordPress site as a user with at least Subscriber-level access.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to a page containing the [advanced-members-account-password] shortcode.\u003c/li\u003e\n\u003cli\u003eAttacker submits the form containing the acf[_amem_local_user_password] parameter.\u003c/li\u003e\n\u003cli\u003eThe plugin's pre_update_value function processes the request and hits the PHP operator-precedence bug.\u003c/li\u003e\n\u003cli\u003eThe authorization logic incorrectly evaluates $user_id as boolean true, bypassing the _can_edit() check.\u003c/li\u003e\n\u003cli\u003eThe system executes wp_update_user(), targeting user ID 1 due to type casting of the boolean ID.\u003c/li\u003e\n\u003cli\u003eThe amem_save_all_fields function overrides the exclusion guard, ensuring the malicious password change is processed.\u003c/li\u003e\n\u003cli\u003eThe administrator account password is overwritten with the attacker-provided value, granting full administrative access.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAuthenticated users with low-level privileges can gain full administrative access to the WordPress site, leading to potential data exfiltration, site defacement, or total system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all WordPress sites utilizing the Advanced Members for ACF plugin.\u003c/li\u003e\n\u003cli\u003eUpdate to a version beyond 1.3.0 immediately when a patch becomes available.\u003c/li\u003e\n\u003cli\u003eDisable the [advanced-members-account-password] shortcode or restrict access to administrative-only pages until a patch is applied.\u003c/li\u003e\n\u003cli\u003eAudit user management logs for unexpected password change events for administrator accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T13:11:59Z","date_published":"2026-11-06T13:11:59Z","id":"https://feed.craftedsignal.io/briefs/2026-11-acf-privilege-escalation/","summary":"An authenticated attacker can escalate privileges to administrator by exploiting a logical error in the Advanced Members for ACF WordPress plugin to overwrite the administrator password.","title":"Advanced Members for ACF: Privilege Escalation via Password Overwrite (CVE-2026-116624)","url":"https://feed.craftedsignal.io/briefs/2026-11-acf-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:advanced_members_for_acf_project:advanced_members_for_acf:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}