---
id: "CVE-2026-116624"
page: "https://infrastack.ai/live/CVE-2026-116624"
kind: "vulnerability"
aliases: ["CVE-2026-116624"]
title: "WordPress Advanced Members for ACF: any logged-in user can take over admin"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "advanced-members", "fixed": ["1.3.1"], "affected": "<= 1.3.0", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["advanced-members-for-acf", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed", "shortcode-not-used"]
published_at: "2026-11-06T12:17:17+00:00"
first_seen_at: "2026-11-06T12:41:48+00:00"
updated_at: "2026-11-06T12:43:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116624", "first_seen_at": "2026-11-06T12:41:48+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-members/advanced-members-for-acf-130-authenticated-subscriber-privilege-escalation-via-account-change-password-form", "first_seen_at": "2026-11-06T12:43:35+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-members/advanced-members-for-acf-130-authenticated-subscriber-privilege-escalation-via-account-change-password-form", "https://wordpress.org/plugins/advanced-members/"]}]
exploit_sources: []
---

# WordPress Advanced Members for ACF: any logged-in user can take over admin

Link for people: https://infrastack.ai/live/CVE-2026-116624 (this .md is for agents)

The Advanced Members for ACF WordPress plugin, up to and including 1.3.0, has a privilege escalation flaw in its account password form. A logged-in user with only Subscriber access can overwrite the password of user ID 1, the primary administrator, and so gain full admin control of the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:advanced-members affected <= 1.3.0 fixed 1.3.1

## How to check

- In WordPress admin > Plugins, check Advanced Members for ACF (slug advanced-members); 1.3.0 and earlier are affected, 1.3.1 is the fixed release.
- Look for the [advanced-members-account-password] shortcode (or the Change Password form block) on pages; any logged-in user, Subscriber and up, can use it.
- Check for unexpected password resets or logins on the user ID 1 admin account.

## Fix

Update Advanced Members for ACF to 1.3.1 or later (changelog: 'Security: Fixed a password update vulnerability'). If you cannot update, deactivate the plugin or remove the [advanced-members-account-password] form from pages, and check whether the primary admin (user ID 1) password was changed.

## Timeline

- 2026-11-06T12:41:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116624
- 2026-11-06T12:43:35+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-members/advanced-members-for-acf-130-authenticated-subscriber-privilege-escalation-via-account-change-password-form — Fix 1.3.1 read on the maintainer's WordPress.org page (changelog does not name the CVE; match is by 'password update vulnerability' and Wordfence range <=1.3.0). Wordfence advisory is the source of the technical detail. Not exploited per sources; no PoC found; X not checked. Only ~30+ active installs.

## Documents

- [advisory] Wordfence: Advanced Members for ACF <= 1.3.0 Subscriber+ Privilege Escalation https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-members/advanced-members-for-acf-130-authenticated-subscriber-privilege-escalation-via-account-change-password-form
- [fix] Advanced Members for ACF - WordPress.org plugin page (changelog 1.3.1) https://wordpress.org/plugins/advanced-members/

## From the sources

The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the `acf[_amem_local_user_password]` parameter of the `[advanced-members-account-password]` shortcode form submission. This is due to a PHP operator-precedence bug in the `pre_update_value` function of `acf/fields/class-user-password.php` that assigns boolean `true` instead of the resolved user ID to `$user_id`, causing the `_can_edit()` authorization check to pass for any logged-in user via PHP loose equality, and causing `wp_update_user()` to cast `'ID' => true` to integer `1` — unconditionally targeting the primary administrator account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the password of user ID 1 (the site's primary administrator) with an attacker-chosen value, granting full administrative access to the site. The intended exclusion guard in `Account::process` that strips the password field before saving is defeated because `amem_save_all_fields()` re-reads the full field list from `amem()->submission` and silently overwrites the caller-supplied excluded fields array with an empty array, ensuring the password field is always processed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_