{"id":"CVE-2026-116624","aliases":["EUVD-2026-118195","GHSA-r29v-jf4c-hpxx"],"status":"published","title":"Advanced Members for ACF \u003c= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation via Account Change-Password Form","description":"The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the `acf[_amem_local_user_password]` parameter of the `[advanced-members-account-password]` shortcode form submission. This is due to a PHP operator-precedence bug in the `pre_update_value` function of `acf/fields/class-user-password.php` that assigns boolean `true` instead of the resolved user ID to `$user_id`, causing the `_can_edit()` authorization check to pass for any logged-in user via PHP loose equality, and causing `wp_update_user()` to cast `'ID' =\u003e true` to integer `1` — unconditionally targeting the primary administrator account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the password of user ID 1 (the site's primary administrator) with an attacker-chosen value, granting full administrative access to the site. The intended exclusion guard in `Account::process` that strips the password field before saving is defeated because `amem_save_all_fields()` re-reads the full field list from `amem()-\u003esubmission` and silently overwrites the caller-supplied excluded fields array with an empty array, ensuring the password field is always processed.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00496,"percentile":0.43097,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2026-11-06T11:17:38Z","modified":"2026-11-06T12:30:50Z","products":[{"vendor":"danbilabs","product":"advanced members for acf"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fc38f0b-bf13-4d01-a4b3-38a43fc726d6?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/advanced-members/tags/1.3.0/acf/fields/class-user-password.php#L117"},{"url":"https://plugins.trac.wordpress.org/browser/advanced-members/tags/1.3.0/acf/fields/base/trait-amem-field.php#L30"},{"url":"https://plugins.trac.wordpress.org/browser/advanced-members/tags/1.3.0/core/functions-forms.php#L105"},{"url":"https://plugins.trac.wordpress.org/browser/advanced-members/tags/1.3.0/core/actions/account.php#L227"},{"url":"https://plugins.svn.wordpress.org/advanced-members/trunk/"},{"url":"https://plugins.trac.wordpress.org/changeset/3779180/advanced-members/trunk/acf/fields/class-user-password.php"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116624"},{"url":"https://plugins.svn.wordpress.org/advanced-members/trunk"},{"url":"https://github.com/advisories/GHSA-r29v-jf4c-hpxx"}],"sources":{"cve":[{"id":"CVE-2026-116624","title":"Advanced Members for ACF \u003c= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation via Account Change-Password Form","description":"The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the `acf[_amem_local_user_password]` parameter of the `[advanced-members-account-password]` shortcode form submission. This is due to a PHP operator-precedence bug in the `pre_update_value` function of `acf/fields/class-user-password.php` that assigns boolean `true` instead of the resolved user ID to `$user_id`, causing the `_can_edit()` authorization check to pass for any logged-in user via PHP loose equality, and causing `wp_update_user()` to cast `'ID' =\u003e true` to integer `1` — unconditionally targeting the primary administrator account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the password of user ID 1 (the site's primary administrator) with an attacker-chosen value, granting full administrative access to the site. The intended exclusion guard in `Account::process` that strips the password field before saving is defeated because `amem_save_all_fields()` re-reads the full field list from `amem()-\u003esubmission` and silently overwrites the caller-supplied excluded fields array with an empty array, ensuring the password field is always processed.","status":"published","published":"2026-11-06T11:17:38.056Z","modified":"2026-11-06T15:16:07.639Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-06T16:58:45.944646Z"}],"euvd":[{"id":"EUVD-2026-118195","description":"The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the `acf[_amem_local_user_password]` parameter of the `[advanced-members-account-password]` shortcode form submission. This is due to a PHP operator-precedence bug in the `pre_update_value` function of `acf/fields/class-user-password.php` that assigns boolean `true` instead of the resolved user ID to `$user_id`, causing the `_can_edit()` authorization check to pass for any logged-in user via PHP loose equality, and causing `wp_update_user()` to cast `'ID' =\u003e true` to integer `1` — unconditionally targeting the primary administrator account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the password of user ID 1 (the site's primary administrator) with an attacker-chosen value, granting full administrative access to the site. The intended exclusion guard in `Account::process` that strips the password field before saving is defeated because `amem_save_all_fields()` re-reads the full field list from `amem()-\u003esubmission` and silently overwrites the caller-supplied excluded fields array with an empty array, ensuring the password field is always processed.","status":"published","published":"2026-11-06T11:17:38Z","modified":"2026-11-06T15:16:07Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T16:05:19.944528Z"}],"ghsa":[{"id":"GHSA-r29v-jf4c-hpxx","title":"The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all...","description":"The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the `acf[_amem_local_user_password]` parameter of the `[advanced-members-account-password]` shortcode form submission. This is due to a PHP operator-precedence bug in the `pre_update_value` function of `acf/fields/class-user-password.php` that assigns boolean `true` instead of the resolved user ID to `$user_id`, causing the `_can_edit()` authorization check to pass for any logged-in user via PHP loose equality, and causing `wp_update_user()` to cast `'ID' =\u003e true` to integer `1` — unconditionally targeting the primary administrator account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the password of user ID 1 (the site's primary administrator) with an attacker-chosen value, granting full administrative access to the site. The intended exclusion guard in `Account::process` that strips the password field before saving is defeated because `amem_save_all_fields()` re-reads the full field list from `amem()-\u003esubmission` and silently overwrites the caller-supplied excluded fields array with an empty array, ensuring the password field is always processed.","status":"published","published":"2026-11-06T12:30:46Z","modified":"2026-11-06T12:30:50Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-06T13:00:05.657094Z"}],"nvd":[{"id":"CVE-2026-116624","description":"The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the `acf[_amem_local_user_password]` parameter of the `[advanced-members-account-password]` shortcode form submission. This is due to a PHP operator-precedence bug in the `pre_update_value` function of `acf/fields/class-user-password.php` that assigns boolean `true` instead of the resolved user ID to `$user_id`, causing the `_can_edit()` authorization check to pass for any logged-in user via PHP loose equality, and causing `wp_update_user()` to cast `'ID' =\u003e true` to integer `1` — unconditionally targeting the primary administrator account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the password of user ID 1 (the site's primary administrator) with an attacker-chosen value, granting full administrative access to the site. The intended exclusion guard in `Account::process` that strips the password field before saving is defeated because `amem_save_all_fields()` re-reads the full field list from `amem()-\u003esubmission` and silently overwrites the caller-supplied excluded fields array with an empty array, ensuring the password field is always processed.","status":"published","published":"2026-11-06T12:17:17.34Z","modified":"2026-11-06T16:17:47.937Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-06T18:00:56.247382Z"}]}}