Quick answers
- Is CVE-2026-14566 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-14566 being exploited in the wild.
- How severe is CVE-2026-14566?
- Medium severity, with a CVSS score of 4.3, published 11 September 2026.
- Which products and versions are affected?
- Advanced Customized Prompts Advanced Customized Prompts through 1.0.1.
- Is there a fix for CVE-2026-14566?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-14566 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-14566?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The plugin contains an Insecure Direct Object Reference (IDOR) vulnerability in WooCommerce order item metadata update functionality. The vulnerability stems from missing capability checks, ownership verification, and nonce validation before processing metadata modifications. Any authenticated user, including those with subscriber-level permissions, can craft requests to update order item metadata for arbitrary orders. The vulnerability allows tampering with custom metadata fields attached to orders, which may include sensitive or business-critical information. No patch has been identified as of the advisory publication date.
Affected products
- Advanced Customized Prompts Advanced Customized Prompts through 1.0.1
Timeline
- 2026-09-09: disclosed
- 2026-09-11: advisory