Executive brief
The Advanced Customized Prompts WordPress plugin contains a critical authentication vulnerability that allows attackers to log in as any user—including administrators—without knowing their password. An attacker can also create arbitrary new accounts. This could lead to complete compromise of a website, with an attacker gaining full control to modify content, steal data, or inject malicious code.
Technical details
The plugin implements an unauthenticated action that issues authenticated sessions based only on a supplied email address, without verifying the password. This is a broken authentication vulnerability (CWE-287) that allows any unauthenticated attacker with network access to send a crafted request containing a victim's email address and receive a valid authenticated session. No preconditions such as prior authentication or user interaction are required. An attacker can achieve account takeover of any registered user or create new privileged accounts, giving them full control over the WordPress installation. The vulnerability affects versions through 1.0.1; no public fix is currently available.
Affected products
- WordPress Advanced Customized Prompts through 1.0.1
Timeline
- 2026-09-09: disclosed: Publicly published on WPScan
- 2026-09-11: advisory: CVE-2026-14563 published
- 2026-09-24: other: Last update: no known fix available