Cpe:2.3:a:advanced_members_for_acf_project:advanced_members_for_acf:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aadvanced_members_for_acf_projectadvanced_members_for_acfwordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 06 Nov 2026 13:11:59 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAdvanced Members for ACF: Privilege Escalation via Password Overwrite (CVE-2026-116624)https://feed.craftedsignal.io/briefs/2026-11-acf-privilege-escalation/Fri, 06 Nov 2026 13:11:59 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-acf-privilege-escalation/An authenticated attacker can escalate privileges to administrator by exploiting a logical error in the Advanced Members for ACF WordPress plugin to overwrite the administrator password.The Advanced Members for ACF WordPress plugin (versions 1.3.0 and below) is vulnerable to privilege escalation via the [advanced-members-account-password] shortcode. An operator-precedence bug in the pre_update_value function within acf/fields/class-user-password.php causes the system to incorrectly authorize password updates by defaulting the $user_id to boolean true, which evaluates to ID 1 via PHP loose equality. Additionally, a flaw in the amem_save_all_fields function fails to respect field exclusion guards, allowing the password update to proceed even if the application expects it to be blocked.

Attack Chain

  1. Attacker authenticates to a WordPress site as a user with at least Subscriber-level access.
  2. Attacker navigates to a page containing the [advanced-members-account-password] shortcode.
  3. Attacker submits the form containing the acf[_amem_local_user_password] parameter.
  4. The plugin's pre_update_value function processes the request and hits the PHP operator-precedence bug.
  5. The authorization logic incorrectly evaluates $user_id as boolean true, bypassing the _can_edit() check.
  6. The system executes wp_update_user(), targeting user ID 1 due to type casting of the boolean ID.
  7. The amem_save_all_fields function overrides the exclusion guard, ensuring the malicious password change is processed.
  8. The administrator account password is overwritten with the attacker-provided value, granting full administrative access.

Impact

Authenticated users with low-level privileges can gain full administrative access to the WordPress site, leading to potential data exfiltration, site defacement, or total system compromise.

Recommendation

  • Identify all WordPress sites utilizing the Advanced Members for ACF plugin.
  • Update to a version beyond 1.3.0 immediately when a patch becomes available.
  • Disable the [advanced-members-account-password] shortcode or restrict access to administrative-only pages until a patch is applied.
  • Audit user management logs for unexpected password change events for administrator accounts.
]]>highadvisorywordpressprivilege-escalationweb-vulnerability