Description

The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to create arbitrary new accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T07:16:46.177Z",
  "pubdate": "2026-09-11T07:16:46.177Z",
  "executiveSummary": "The advanced-customized-prompts WordPress plugin up to version 1.0.1 is affected by a critical authentication bypass vulnerability. The flaw exists in an unauthenticated action that fails to perform adequate credential verification when processing user login requests.\nBy submitting a target email address to the affected endpoint, an attacker can hijack an authenticated session without possessing the associated password. This allows unauthorized access to any registered account, including those with administrative privileges, or the arbitrary creation of new accounts.\nThe vulnerability poses a severe risk, as it permits full account takeover and potential remote code execution if an administrative account is compromised. The attack requires no prior authentication and can be executed over the network by any unauthenticated remote actor.\nImmediate remediation is required to ensure that session generation is protected by rigorous password validation logic and appropriate security nonce checks.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of authentication logic within the plugin's backend request handlers. Specifically, the component responsible for processing login actions fails to invoke necessary password verification routines (such as wp_check_password) prior to establishing a new session for a user identified by a supplied email address.\nThe vulnerability manifests in an unauthenticated action exposed by the advanced-customized-prompts plugin. Typically, WordPress authentication flows rely on the integration of standard authentication hooks and verification functions. In this instance, the plugin appears to bypass these security controls by manually creating a session state or returning authentication tokens based solely on the presence of an email identifier.\nThe attack flow proceeds as follows: First, the attacker identifies the endpoint exposed by the plugin for handling login or user creation requests. Second, the attacker crafts a malicious request (typically via HTTP POST) containing the email address of the target victim. Third, because the underlying code lacks a conditional check to validate the password hash against the provided input, the application proceeds to authenticate the request as if valid credentials were provided. Finally, the server issues a valid session cookie or authorization token, effectively logging the attacker into the application as the targeted user.\nBecause this mechanism exists in an unauthenticated context, the attacker is not required to interact with the standard WordPress login page or possess any valid credentials. The lack of nonce verification further facilitates this exploit by allowing the attacker to bypass Cross-Site Request Forgery (CSRF) protections that are standard in the WordPress environment.\nThe impact of this flaw is critical. Successful exploitation leads to a complete account takeover. An attacker can assume the role of an administrator, which grants them full control over the WordPress instance, including the ability to modify plugin configurations, inject malicious code into the site, or exfiltrate sensitive user data. Furthermore, the ability to create arbitrary new accounts allows the attacker to maintain persistent access to the environment even if the targeted account is subsequently secured."
}