Quick answers
- Is CVE-2026-14563 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-14563 being exploited in the wild.
- How severe is CVE-2026-14563?
- Critical severity, with a CVSS score of 9.8, published 11 September 2026.
- Which products and versions are affected?
- Wordpress Advanced Customized Prompts through 1.0.1.
- Is there a fix for CVE-2026-14563?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-14563 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-14563?
- Check whether you run Wordpress Advanced Customized Prompts at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The plugin implements an unauthenticated action that issues authenticated sessions based only on a supplied email address, without verifying the password. This is a broken authentication vulnerability (CWE-287) that allows any unauthenticated attacker with network access to send a crafted request containing a victim's email address and receive a valid authenticated session. No preconditions such as prior authentication or user interaction are required. An attacker can achieve account takeover of any registered user or create new privileged accounts, giving them full control over the WordPress installation. The vulnerability affects versions through 1.0.1; no public fix is currently available.
Affected products
- WordPress Advanced Customized Prompts through 1.0.1
Timeline
- 2026-09-09: disclosed: Publicly published on WPScan
- 2026-09-11: advisory: CVE-2026-14563 published
- 2026-09-24: other: Last update: no known fix available