CVE-2026-116624: Advanced Members for ACF <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation via Account Change-Password Form
The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the acf[amemlocaluserpassword] parameter of the [advanced-members-account-password] shortcode form submission. This is due to a PHP operator-precedence bug in the preupdatevalue function of acf/fields/class-user-password.php that assigns boolean true instead of the resolved user ID to $userid, causing the canedit() authorization check to pass for any logged-in user via PHP loose equality, and causing wpupdateuser() to cast 'ID' => true to integer 1 — unconditionally targeting the primary administrator account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the password of user ID 1 (the site's primary administrator) with an attacker-chosen value, granting full administrative access to the site. The intended exclusion guard in Account::process that strips the password field before saving is defeated because amemsaveallfields() re-reads the full field list from amem()->submission and silently overwrites the caller-supplied excluded fields array with an empty array, ensuring the password field is always processed.
Event History
Frequently Asked Questions
What level of access does an attacker need?
Any authenticated WordPress user with Subscriber-level access or higher can exploit the issue. No user interaction is required.
Which account is affected by a successful exploit?
The vulnerable update path targets WordPress user ID 1, identified as the site’s primary administrator account. An attacker can set that account’s password to a value they choose and then log in with administrative access.
Which installations are in scope?
All plugin versions through 1.3.0 are affected. The described attack path uses the account password form provided by the advanced-members-account-password shortcode.