CVE-2026-116624

The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the acf[_amem_local_user_password] parameter of the [advanced-members-account-password] shortcode form submission. This is due to a PHP operator-precedence bug in the pre_update_value function of acf/fields/class-user-password.php that assigns boolean true instead of the resolved user ID to $user_id, causing the _can_edit() authorization check to pass for any logged-in user via PHP loose equality, and causing wp_update_user() to cast 'ID' => true to integer 1 — unconditionally targeting the primary administrator account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the password of user ID 1 (the site's primary administrator) with an attacker-chosen value, granting full administrative access to the site. The intended exclusion guard in Account::process that strips the password field before saving is defeated because amem_save_all_fields() re-reads the full field list from amem()->submission and silently overwrites the caller-supplied excluded fields array with an empty array, ensuring the password field is always processed.

The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the acf[_amem_local_user_password] parameter of the [advanced-members-account-password] shortcode form submission. This is due to a PHP operator-precedence bug in the pre_update_value function of acf/fields/class-user-password.php that assigns boolean true instead of the resolved user ID to $user_id, causing the _can_edit() authorization check to pass for any logged-in user via PHP loose equality, and causing wp_update_user() to cast 'ID' => true to integer 1 — unconditionally targeting the primary administrator account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the password of user ID 1 (the site's primary administrator) with an attacker-chosen value, granting full administrative access to the site. The intended exclusion guard in Account::process that strips the password field before saving is defeated because amem_save_all_fields() re-reads the full field list from amem()->submission and silently overwrites the caller-supplied excluded fields array with an empty array, ensuring the password field is always processed.

The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the acf[_amem_local_user_password] parameter of the [advanced-members-account-password] shortcode form submission. This is due to a PHP operator-precedence bug in the pre_update_value function of acf/fields/class-user-password.php that assigns boolean true instead of the resolved user ID to $user_id, causing the _can_edit() authorization check to pass for any logged-in user via PHP loose equality, and causing wp_update_user() to cast 'ID' => true to integer 1 — unconditionally targeting the primary administrator account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the password of user ID 1 (the site's primary administrator) with an attacker-chosen value, granting full administrative access to the site. The intended exclusion guard in Account::process that strips the password field before saving is defeated because amem_save_all_fields() re-reads the full field list from amem()->submission and silently overwrites the caller-supplied excluded fields array with an empty array, ensuring the password field is always processed.

The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the acf[_amem_local_user_password] parameter of the [advanced-members-account-password] shortcode form submission. This is due to a PHP operator-precedence bug in the pre_update_value function of acf/fields/class-user-password.php that assigns boolean true instead of the resolved user ID to $user_id, causing the _can_edit() authorization check to pass for any logged-in user via PHP loose equality, and causing wp_update_user() to cast 'ID' => true to integer 1 — unconditionally targeting the primary administrator account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the password of user ID 1 (the site's primary administrator) with an attacker-chosen value, granting full administrative access to the site. The intended exclusion guard in Account::process that strips the password field before saving is defeated because amem_save_all_fields() re-reads the full field list from amem()->submission and silently overwrites the caller-supplied excluded fields array with an empty array, ensuring the password field is always processed.