CVE-2026-14566: Advanced Customized Prompts <= 1.0.1 - Subscriber+ WooCommerce Order Item Metadata Tampering
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belonging to other customers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
advanced-customized-prompts (WordPress plugin)to a version that resolves this vulnerability.Fixed in 1.0.1 - Compensating control
Restrict authenticated access to actions that trigger updating WooCommerce order item metadata (e.g., limit to trusted roles/admin) until the plugin is upgraded.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user, including a user with only the Subscriber role, can exploit it. The affected plugin does not verify the user's capability or ownership of the targeted order.
What access does an attacker need?
The attacker needs a valid authenticated WordPress account. No authorization to manage WooCommerce orders or access to the targeted customer's order is required.
What can an attacker change?
An attacker can update custom WooCommerce order item metadata for a supplied order, including orders belonging to other customers. The available data does not specify which metadata fields can be altered or the resulting business impact.
How can I determine whether my site is affected?
Sites using the Advanced Customized Prompts WordPress plugin version 1.0.1 or earlier are affected. Review whether untrusted users can register or otherwise obtain authenticated accounts, as those accounts can be used to target other customers' orders.