Description

The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the `acf[_amem_local_user_password]` parameter of the `[advanced-members-account-password]` shortcode form submission. This is due to a PHP operator-precedence bug in the `pre_update_value` function of `acf/fields/class-user-password.php` that assigns boolean `true` instead of the resolved user ID to `$user_id`, causing the `_can_edit()` authorization check to pass for any logged-in user via PHP loose equality, and causing `wp_update_user()` to cast `'ID' => true` to integer `1` — unconditionally targeting the primary administrator account. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the password of user ID 1 (the site's primary administrator) with an attacker-chosen value, granting full administrative access to the site. The intended exclusion guard in `Account::process` that strips the password field before saving is defeated because `amem_save_all_fields()` re-reads the full field list from `amem()->submission` and silently overwrites the caller-supplied excluded fields array with an empty array, ensuring the password field is always processed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-11-06T12:17:17.340Z",
  "pubdate": "2026-11-06T12:17:17.340Z",
  "executiveSummary": "The Advanced Members for ACF plugin for WordPress, in all versions up to and including 1.3.0, contains a critical privilege escalation vulnerability. The flaw originates from improper input handling and flawed authorization checks within the password field processing logic of the 'advanced-members-account-password' shortcode.\nBy manipulating the 'acf[_amem_local_user_password]' parameter, an authenticated attacker with at least Subscriber-level privileges can force the application to overwrite the password of the primary site administrator (user ID 1). This vulnerability grants the attacker full administrative control over the affected WordPress installation.\nThe root cause involves a PHP operator-precedence bug that misassigns a boolean value during the 'pre_update_value' function execution, coupled with a security control failure in the 'Account::process' method. This allows unauthorized password updates to bypass intended restrictions. Given the high impact—full site compromise—and the low barrier to entry (standard user authentication), this vulnerability poses a severe risk to site integrity and security.",
  "technicalDetails": "The vulnerability is situated within 'acf/fields/class-user-password.php' and is triggered by the processing logic of the 'advanced-members-account-password' shortcode. The primary failure occurs in the 'pre_update_value' function, where an incorrect application of PHP operator precedence results in the '$user_id' variable being assigned a boolean 'true' value instead of the expected target user ID.\nThis boolean assignment bypasses the security '_can_edit()' function. Due to PHP's loose equality comparison behavior, the authorization check resolves to true, effectively permitting any authenticated user to proceed with the update operation. Furthermore, when the process reaches 'wp_update_user()', the application passes an array containing 'ID' => true. WordPress's 'wp_update_user' function casts this boolean value to an integer, which evaluates to '1'. Consequently, the operation is directed against the site's primary administrator account regardless of the user's intended target.\nThe exploitation path is further facilitated by a secondary logic failure in 'Account::process'. While this component attempts to implement an exclusion guard to strip sensitive fields like passwords before persistence, the 'amem_save_all_fields()' function re-reads the input from 'amem()->submission'. During this process, the plugin silently overwrites the caller-supplied list of excluded fields with an empty array. This action nullifies the security guard, ensuring that the password field is processed and persisted into the database even when it should have been blocked.\nAn attacker can exploit this by submitting a crafted request to the 'advanced-members-account-password' form, injecting a new password value into the 'acf[_amem_local_user_password]' parameter. Because the authorization logic is bypassed and the intended exclusion guard is defeated, the system proceeds to update user ID 1 with the attacker-controlled password. The impact is absolute: the attacker gains unauthorized administrative access to the WordPress environment, allowing for full system compromise, remote code execution through plugin/theme installation, and exfiltration of sensitive site data."
}