CVE-2026-15354: ACPT (Premium) <= 2.0.66 - Unauthenticated Privilege Escalation via 'acpt_form_post_id' Parameter
The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.66. This is due to missing authorization in the submit() function, which allows unauthenticated form submissions to control the target user ID before calling wpupdateuser(). This makes it possible for unauthenticated attackers to overwrite any WordPress user's email address and password, including an administrator's, and take over the account. Successful exploitation requires a public ACPT user form that permits anonymous submissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress ACPT (Premium) pluginto a version that resolves this vulnerability.Fixed in 2.0.66 - Compensating control
Ensure the public ACPT user form does not permit anonymous submissions (disable or restrict anonymous form submissions) so unauthenticated attackers cannot exploit the acpt_form_post_id parameter to overwrite user email/password.
Event History
Frequently Asked Questions
Which sites are exposed to unauthenticated account takeover?
Sites running ACPT (Premium) version 2.0.66 or earlier are exposed if they have a public ACPT user form that allows anonymous submissions. The issue can be exploited remotely without authentication or user interaction.
What can an attacker do after exploiting this issue?
An attacker can control the target user ID during a form submission and overwrite the email address and password of any WordPress user, including an administrator. This can allow the attacker to take over that account.
What condition is required for exploitation?
A public ACPT user form that permits anonymous submissions must be available. The provided information does not indicate that exploitation succeeds without such a form.