{"id":"CVE-2026-116624","kind":"vulnerability","aliases":["CVE-2026-116624"],"related":[],"title":"WordPress Advanced Members for ACF: any logged-in user can take over admin","description":"The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the `acf[_amem_local_user_password]` parameter of the `[advanced-members-account-password]` shortcode form submission. This is due to a PHP operator-precedence bug in the `pre_update_value` function of `acf/fields/class-user-password.php` that assigns boolean `true` instead of the resolved user ID to `$user_id`, causing the `_can_edit()` authorization check to pass for any logged-in user via PHP loose equality, and causing `wp_update_user()` to cast `'ID' => true` to integer `1` — unconditionally targeting the primary administrator account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the password of user ID 1 (the site's primary administrator) with an attacker-chosen value, granting full administrative access to the site. The intended exclusion guard in `Account::process` that strips the password field before saving is defeated because `amem_save_all_fields()` re-reads the full field list from `amem()->submission` and silently overwrites the caller-supplied excluded fields array with an empty array, ensuring the password field is always processed.","summary":"The Advanced Members for ACF WordPress plugin, up to and including 1.3.0, has a privilege escalation flaw in its account password form. A logged-in user with only Subscriber access can overwrite the password of user ID 1, the primary administrator, and so gain full admin control of the site.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"advanced-members","fixed":["1.3.1"],"affected":"<= 1.3.0","ecosystem":"wordpress"}],"ecosystems":[],"tags":["advanced-members-for-acf","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","shortcode-not-used"],"how_to_check":"- In WordPress admin > Plugins, check Advanced Members for ACF (slug advanced-members); 1.3.0 and earlier are affected, 1.3.1 is the fixed release.\n- Look for the [advanced-members-account-password] shortcode (or the Change Password form block) on pages; any logged-in user, Subscriber and up, can use it.\n- Check for unexpected password resets or logins on the user ID 1 admin account.","fix":"Update Advanced Members for ACF to 1.3.1 or later (changelog: 'Security: Fixed a password update vulnerability'). If you cannot update, deactivate the plugin or remove the [advanced-members-account-password] form from pages, and check whether the primary admin (user ID 1) password was changed.","status":"open","published_at":"2026-11-06T12:17:17+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","triaged_at":"2026-11-06T12:42:38+00:00","updated_at":"2026-11-06T12:43:35+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-06T12:42:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Advanced Members for ACF: any logged-in user can take over admin","impact":"high","summary":"The Advanced Members for ACF WordPress plugin, up to and including 1.3.0, has a privilege escalation flaw in its account password form. A logged-in user with only Subscriber access can overwrite the password of user ID 1, the primary administrator, and so gain full admin control of the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","advanced-members-for-acf","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker takes over the primary administrator account and the whole site","analyst_note":"Confirm the fixed version of Advanced Members for ACF and whether a patch exists; the sources give none beyond the affected range up to 1.3.0.","how_to_check":"- Check the installed version of the Advanced Members for ACF plugin in the WordPress admin under Plugins; versions up to and including `1.3.0` are affected.\n- Look for the `[advanced-members-account-password]` shortcode on pages the site serves.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","shortcode-not-used"],"who_is_affected":"Sites running the Advanced Members for ACF plugin up to and including 1.3.0 that use the account password shortcode form, where any registered user can submit it. Sites without this plugin, or without the shortcode form, are not exposed. The sources do not state a fixed version.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000749,"input_tokens":4545,"output_tokens":590,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version of Advanced Members for ACF and whether a patch exists; the sources give none beyond the affected range up to 1.3.0.","search":"'-116624':17A,20A '-2026':16A,19A '1':72B,184C,212C '1.3.0':45B,105C 'access':64B,202C,227C 'account':53B,119C,190C,236C 'acf':5A,28B,38B,89C,108C 'acf/fields/class-user-password.php':141C 'admin':14A,80B 'administr':75B,189C,217C,226C 'advanc':2A,25B,35B,86C,117C 'advanced':22A 'advanced-members':21A 'advanced-members-account-password':116C 'advanced-members-for-acf':24B 'alway':281C 'amem':109C,248C,260C 'array':271C,275C 'assign':143C 'attack':197C,221C 'attacker-chosen':220C 'authent':196C 'author':159C 'boolean':144C 'bug':133C 'caller':267C 'caller-suppli':266C 'cast':179C 'caus':155C,174C 'check':160C 'chosen':222C 'control':81B 'cve':15A,18A 'defeat':246C 'due':126C 'edit':158C 'empti':274C 'ensur':276C 'equal':172C 'escal':49B,97C 'exclud':269C 'exclus':233C 'field':242C,251C,257C,270C,279C 'flaw':50B 'form':55B,122C 'full':79B,225C,256C 'function':139C 'gain':78B 'grant':224C 'guard':234C 'host':32B 'id':71B,151C,154C,180C,211C 'includ':44B,104C 'instead':146C 'integ':183C 'intend':232C 'level':201C 'list':258C 'local':110C 'log':8A,58B,166C 'logged-in':7A,57B,165C 'loos':171C 'make':192C 'member':3A,26B,36B,87C,118C 'members':23A 'oper':131C 'operator-preced':130C 'overwrit':66B,206C,264C 'packag':29B 'paramet':113C 'pass':162C 'password':54B,68B,112C,120C,208C,241C,278C 'php':129C,170C 'plugin':40B,90C 'possibl':194C 'pre':136C 'preced':132C 'primari':74B,188C,216C 'privileg':48B,96C 'process':237C,282C 're':253C 're-read':252C 'read':254C 'resolv':149C 'save':244C,249C 'self':31B 'self-host':30B 'shortcod':121C 'silent':263C 'site':84B,214C,230C 'strip':239C 'submiss':123C,261C 'subscrib':63B,200C 'subscriber-level':199C 'suppli':268C 'take':12A 'target':186C 'true':145C,181C 'uncondit':185C 'updat':137C,176C 'user':10A,60B,70B,111C,150C,153C,168C,177C,210C 'valu':138C,223C 'version':100C 'via':106C,169C 'vulner':94C 'wordpress':1A,33B,39B,92C 'wp':175C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Advanced Members for ACF plugin up to and including 1.3.0 that use the account password shortcode form, where any registered user can submit it. Sites without this plugin, or without the shortcode form, are not exposed. The sources do not state a fixed version.","tier":"B","verified":{"fix":{"at":"2026-11-06T12:43:35Z","by":"analyst","doc":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-members/advanced-members-for-acf-130-authenticated-subscriber-privilege-escalation-via-account-change-password-form","run_id":1890}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["advancedmembers"],"ptokens":["advanced","members"],"labels":["advancedmembersforacf","high","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-116624':17A,20A '-2026':16A,19A 'acf':5A 'admin':14A 'advanc':2A 'advanced':22A 'advanced-members':21A 'cve':15A,18A 'log':8A 'logged-in':7A 'member':3A 'members':23A 'take':12A 'user':10A 'wordpress':1A","search_b":"'1':72B '1.3.0':45B 'access':64B 'account':53B 'acf':28B,38B 'admin':80B 'administr':75B 'advanc':25B,35B 'advanced-members-for-acf':24B 'control':81B 'escal':49B 'flaw':50B 'form':55B 'full':79B 'gain':78B 'host':32B 'id':71B 'includ':44B 'log':58B 'logged-in':57B 'member':26B,36B 'overwrit':66B 'packag':29B 'password':54B,68B 'plugin':40B 'primari':74B 'privileg':48B 'self':31B 'self-host':30B 'site':84B 'subscrib':63B 'user':60B,70B 'wordpress':33B,39B","search_c":"'1':184C,212C '1.3.0':105C 'access':202C,227C 'account':119C,190C,236C 'acf':89C,108C 'acf/fields/class-user-password.php':141C 'administr':189C,217C,226C 'advanc':86C,117C 'advanced-members-account-password':116C 'alway':281C 'amem':109C,248C,260C 'array':271C,275C 'assign':143C 'attack':197C,221C 'attacker-chosen':220C 'authent':196C 'author':159C 'boolean':144C 'bug':133C 'caller':267C 'caller-suppli':266C 'cast':179C 'caus':155C,174C 'check':160C 'chosen':222C 'defeat':246C 'due':126C 'edit':158C 'empti':274C 'ensur':276C 'equal':172C 'escal':97C 'exclud':269C 'exclus':233C 'field':242C,251C,257C,270C,279C 'form':122C 'full':225C,256C 'function':139C 'grant':224C 'guard':234C 'id':151C,154C,180C,211C 'includ':104C 'instead':146C 'integ':183C 'intend':232C 'level':201C 'list':258C 'local':110C 'log':166C 'logged-in':165C 'loos':171C 'make':192C 'member':87C,118C 'oper':131C 'operator-preced':130C 'overwrit':206C,264C 'paramet':113C 'pass':162C 'password':112C,120C,208C,241C,278C 'php':129C,170C 'plugin':90C 'possibl':194C 'pre':136C 'preced':132C 'primari':188C,216C 'privileg':96C 'process':237C,282C 're':253C 're-read':252C 'read':254C 'resolv':149C 'save':244C,249C 'shortcod':121C 'silent':263C 'site':214C,230C 'strip':239C 'submiss':123C,261C 'subscrib':200C 'subscriber-level':199C 'suppli':268C 'target':186C 'true':145C,181C 'uncondit':185C 'updat':137C,176C 'user':111C,150C,153C,168C,177C,210C 'valu':138C,223C 'version':100C 'via':106C,169C 'vulner':94C 'wordpress':92C 'wp':175C","first_public_at":"2026-11-06T12:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116624","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116624","severity":null,"published_at":"2026-11-06T12:17:17+00:00","modified_at":"2026-11-06T12:17:17+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","fetched_at":"2026-11-06T12:41:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116624:1890","url":"https://wordpress.org/plugins/advanced-members/","severity":null,"published_at":"2026-11-06T12:43:35+00:00","modified_at":"2026-11-06T12:43:35+00:00","first_seen_at":"2026-11-06T12:43:35+00:00","fetched_at":"2026-11-06T12:43:35+00:00","note":"Fix 1.3.1 read on the maintainer's WordPress.org page (changelog does not name the CVE; match is by 'password update vulnerability' and Wordfence range <=1.3.0). Wordfence advisory is the source of the technical detail. Not exploited per sources; no PoC found; X not checked. Only ~30+ active installs.","cites":["https://wordpress.org/plugins/advanced-members/","https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-members/advanced-members-for-acf-130-authenticated-subscriber-privilege-escalation-via-account-change-password-form"]}],"documents":[{"id":86425,"url":"https://wordpress.org/plugins/advanced-members/","title":"Advanced Members for ACF - WordPress.org plugin page (changelog 1.3.1)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":86426,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-members/advanced-members-for-acf-130-authenticated-subscriber-privilege-escalation-via-account-change-password-form","title":"Wordfence: Advanced Members for ACF <= 1.3.0 Subscriber+ Privilege Escalation","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}