CVE-2026-14566 in Advanced Customized Prompts Plugin
Summary
by MITRE • 09/11/2026
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belonging to other customers.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in the advanced-customized-prompts WordPress plugin versions through 1.0.1 represents a critical failure in access control mechanisms within the context of WooCommerce order management. This flaw allows authenticated users, including those with the lowest privilege level such as subscribers, to manipulate sensitive data associated with customer orders. The core issue lies in the absence of proper authorization checks before processing updates to WooCommerce order item metadata. In secure web application design, any action that modifies state or alters database records must verify not only that the user is authenticated but also that they possess the specific capabilities required for that operation and hold a valid nonce to prevent cross-site request forgery attacks. The plugin fails to implement these essential safeguards, effectively treating all authenticated requests as legitimate administrative actions regardless of the requester's actual role or permission set.
From a technical perspective, this vulnerability is classified under CWE-269, which denotes Improper Privilege Control. By neglecting to validate user capabilities against the requested action, the application exposes its data integrity mechanisms to unauthorized modification. Furthermore, the lack of nonce verification aligns with CWE-352, describing Cross-Site Request Forgery vulnerabilities. An attacker can craft a malicious request that triggers the metadata update endpoint without requiring any additional interaction from the victim beyond being logged into their WordPress account. This means that if an administrator or shop manager visits a page controlled by an attacker while authenticated to the vulnerable site, the attack could execute silently in the background due to the browser automatically sending session cookies with the forged request.
The operational impact of this vulnerability is severe for any e-commerce platform relying on WooCommerce and this specific plugin. Order item metadata often contains sensitive information such as custom product options, pricing adjustments, shipping instructions, or internal notes that are critical for order fulfillment and customer service. An attacker can alter these fields to disrupt business operations, cause financial loss by modifying prices or quantities, or inject malicious content into the system's data store. For instance, an attacker could change a high-value item to a low-cost alternative in another user's pending order, leading to significant revenue leakage. Alternatively, they might corrupt shipping details, causing orders to be delivered incorrectly and damaging customer trust. The ability of a subscriber-level user to perform these actions indicates a fundamental breakdown in the principle of least privilege, allowing minimal-privilege accounts to exert administrative influence over critical business data.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The most effective solution is to upgrade the advanced-customized-prompts plugin to version 1.0.2 or later, where these authorization checks have presumably been implemented by the developers. If upgrading is not immediately feasible, temporary mitigations include restricting access to WordPress admin pages for subscriber-level users and ensuring that no other plugins with similar vulnerabilities are installed. It is also advisable to audit user roles within the WordPress environment to ensure that only trusted individuals hold elevated privileges such as shop manager or administrator. Additionally, implementing a Web Application Firewall can help detect and block suspicious patterns of metadata manipulation attempts, although this serves as a compensating control rather than a fix for the underlying code flaw. Regular security audits and adherence to secure coding standards like those outlined in OWASP guidelines are essential to prevent similar privilege escalation issues in future development cycles.