Description

The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.66. This is due to missing authorization in the `submit()` function, which allows unauthenticated form submissions to control the target user ID before calling `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite any WordPress user's email address and password, including an administrator's, and take over the account. Successful exploitation requires a public ACPT user form that permits anonymous submissions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-04T07:17:08.487Z",
  "pubdate": "2026-09-04T07:17:08.487Z",
  "executiveSummary": "The ACPT (Premium) WordPress plugin, in versions up to and including 2.0.66, contains a critical security vulnerability involving improper authorization controls. The flaw is identified as a privilege escalation vulnerability that allows unauthenticated remote attackers to modify arbitrary user accounts.\nThe root cause lies in the plugin's 'submit()' function, which processes form data without performing necessary verification of user permissions or authorization tokens. Because the application blindly trusts the user-supplied input to define the target account for 'wp_update_user()', an attacker can manipulate the request parameters to target any registered user, including administrative accounts.\nThe impact of this vulnerability is severe, as it grants unauthorized actors the ability to modify critical account credentials, specifically email addresses and passwords. By successfully overwriting the credentials of a high-privileged user, an attacker can effectively seize control of the entire WordPress installation. This exploitation requires the availability of a publicly accessible ACPT form that allows anonymous submissions. Given the ease of exploitation and the potential for total system compromise, this vulnerability poses a high risk to the confidentiality, integrity, and availability of affected WordPress environments.",
  "technicalDetails": "The vulnerability resides within the 'submit()' function of the ACPT (Premium) plugin, which handles form submissions. The primary failure is a complete lack of authorization checks, permitting unauthenticated visitors to trigger the backend logic intended for processing user-submitted forms. When a form is submitted, the plugin logic does not validate the sender's identity or ensure the requester has the authority to modify the specific user account designated in the request payload.\nThe exploitation process hinges on the insecure handling of the target user ID within the 'submit()' function. Specifically, the function calls 'wp_update_user()' to process updates to user metadata or profile information. In its vulnerable state, the code allows the attacker to pass an arbitrary 'user_id' parameter within the HTTP request. The backend application uses this parameter to identify the target account to be updated. By intercepting or crafting a specially formed request, an attacker can input the ID of an administrator or any other high-privileged user account.\nThe attack flow follows a structured path: First, the attacker identifies a publicly accessible ACPT form configured for anonymous usage. Second, the attacker captures the submission request to determine the parameter structure. Third, the attacker manipulates the request to include the 'user_id' of the intended target. Fourth, the attacker injects new credentials—specifically a new email address and a password—into the payload fields processed by 'wp_update_user()'.\nOnce the malicious request is submitted, 'wp_update_user()' executes with the attacker's supplied parameters, overwriting the legitimate account information. Because the system performs no authorization verification, the update is committed to the database. Post-exploitation, the attacker can leverage the newly set password to authenticate as the target user, effectively achieving a full account takeover. The scope of this issue is significant because it bypasses standard WordPress authentication mechanisms, requiring no existing credentials or sessions on the part of the attacker. The vulnerability is present across all versions up to 2.0.66, making all implementations using publicly available forms inherently insecure."
}