CVE-2026-15354 in ACPT Plugin
Summary
by MITRE • 09/04/2026
The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.66. This is due to missing authorization in the `submit()` function, which allows unauthenticated form submissions to control the target user ID before calling `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite any WordPress user's email address and password, including an administrator's, and take over the account. Successful exploitation requires a public ACPT user form that permits anonymous submissions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in the ACPT Premium plugin for WordPress represents a critical security flaw rooted in insufficient access control mechanisms within the application logic. Specifically, this issue manifests as a privilege escalation vector affecting all versions of the plugin up to and including version 2.0.66. The core technical deficiency lies within the `submit()` function, which fails to enforce proper authorization checks before processing user input data. This architectural oversight allows unauthenticated actors to interact with sensitive administrative functions without possessing valid credentials or session tokens that would normally be required for such operations.
From a technical perspective, the flaw enables attackers to manipulate critical fields associated with WordPress user accounts by exploiting the lack of validation on the target user ID parameter. By submitting crafted forms through public-facing ACPT interfaces that permit anonymous submissions, an attacker can specify any existing user identifier within the database. The system then proceeds to execute `wp_update_user()` using these externally controlled values, effectively bypassing standard security boundaries. This mechanism allows for the complete overwrite of a target account's email address and password fields without requiring authentication or verification steps typically mandated by WordPress core functionality.
The operational impact of this vulnerability is severe, as it facilitates full account takeover across all user roles within the affected WordPress installation. An unauthenticated attacker can select an administrator-level account from the database and reset its credentials to values known only to the adversary. This results in a complete compromise of administrative privileges, granting the attacker unrestricted access to the entire website environment. With such elevated permissions, the threat actor can modify site configurations, install malicious plugins or themes, exfiltrate sensitive data stored within the WordPress database, and potentially use the compromised server as a pivot point for further network intrusions.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures in validating user identity before performing privileged actions. Furthermore, it maps to MITRE ATT&CK technique T1078, Valid Accounts, where adversaries leverage legitimate credentials or create new ones through exploitation of authentication bypasses to maintain persistent access and escalate privileges within the target environment. The attack vector is classified as remote with no additional prerequisites other than network connectivity to a public-facing form endpoint that accepts anonymous submissions.
To mitigate this risk, administrators must immediately update the ACPT Premium plugin to version 2.0.67 or later, where these authorization checks have been properly implemented. In environments where immediate patching is not feasible due to compatibility concerns, temporary mitigations should include disabling public access to any user forms that allow anonymous submissions until an upgrade can be performed. Additionally, implementing strict input validation and ensuring that all administrative functions require verified session tokens or nonces can help prevent similar exploitation patterns in other plugins or custom code. Regular security audits of form handling logic are recommended to ensure that privilege escalation vectors remain closed as the application evolves.